Bug Bounty Program

Included domains and services: wajub.com, api.wajub.com, dashboard.wajub.com, pay.wajub.com, wajub.link, docs.wajub.com, the public REST API, the CLI and the official SDKs published at github.com/wajubhq. Excluded: merchant sites, third-party Providers (operators, aggregators, card providers), our hosting providers' infrastructure, status.wajub.com (third-party service), physical attacks, denial-of-service attacks and social engineering.

Rewarded vulnerabilities: XSS (stored, reflected, DOM-based), CSRF on sensitive actions, SSRF with demonstrated impact, injections (SQL, NoSQL, LDAP, OS command), IDOR, authentication bypass, privilege escalation, business logic flaws with impact, sensitive data exposure, subdomain takeover, race conditions, and mass assignment. Not eligible: self-XSS, missing HTTP security headers without impact, non-sensitive clickjacking, version disclosure, rate limiting without business impact, and automated reports without proof of concept.

Wajub may grant a reward, at its discretion, based on the severity of the vulnerability, its demonstrated impact and the quality of the report. Whether a reward is granted, and its amount, is confirmed to the researcher after the fix is validated. No reward scale is guaranteed.

Researchers undertake to act in good faith, not to exploit the vulnerability beyond demonstration, not to access or modify data that does not belong to them, not to disclose before remediation (default period of 90 days), and not to use brute force or DoS attacks. Wajub undertakes not to pursue legal action against researchers acting in good faith (safe harbour) and to handle reports professionally.

Reports must be sent to security@wajub.com. A good report contains: a clear title, the vulnerability type (CWE/OWASP), the affected URL or component, detailed reproduction steps, a proof of concept, the potential impact and the test environment. Wajub acknowledges reports, keeps the researcher informed of progress and lets them know when the fix is deployed.

Wajub reserves the right to exclude a researcher in the event of non-compliance with the rules, premature public disclosure, attacks beyond the necessary scope, attempted extortion or blackmail, or harassment of the team. Wajub reserves the right to modify the programme terms at any time; changes are published on this page.