BitGo’s Bug Bounty Program allows developers to discover and resolve bugs before the general public is aware of such bugs, preventing incidents of widespread abuse. If you find a security vulnerability on the BitGo API, open source software, libraries, or website please let us know right away. Please review the following information before submitting a report.
Responsible Disclosure Policy
If you give us reasonable time to respond to your report before making any information public and make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service during your research, we will not bring any lawsuit against you or ask law enforcement to investigate you. We would prefer to give you recognition for your efforts, but you can remain anonymous at your discretion and be paid in cryptocurrency.
- Hall of Fame: if you send in a qualifying vulnerability, at your discretion BitGo will list your name on our website.
- Your name will be submitted with your discretion with any CVEs registered if public disclosure is appropriate.
- Your choice of cryptocurrency at various reward tiers.
- Job opportunities! We are frequently hiring talented security researchers with strong communication skills. Finding bugs and communicating them well is a great way to get our attention
Attributes of a Helpful Vulnerability:
- You’re the first person to responsibly disclose the security vulnerability.
- The reported vulnerability could compromise the integrity of user data, circumvent the privacy protections of user data, or enable access to a system within our infrastructure, such as:
– Cross-Site Scripting (XSS)
– Cross-Site Request Forgery (CSRF/XSR)
– Broken Authentication
– Circumvention of our Platform/Privacy permission models
– Remote Code Execution
– Privilege Escalation
– Provisioning Errors
- While investigating vulnerabilities, you made every attempt to use a test account instead of a real account.
- While investigating vulnerabilities you did not cause any service disruption for BitGo customers.
– We will still never prosecute you if you adhered to our responsible disclosure policy and caused no damages beyond very short term Denial of Service, however irresponsible testing methods may impact your reward level.
- While investigating vulnerabilities, you had no interaction with other accounts without the consent of their owners.
How to Send a Report:
- If you find a security vulnerability that meets the above qualifications, please contact BitGo at firstname.lastname@example.org.
- Please encrypt communications to this address through our PGP Public Key: 0x3120ec2d8f47193a
What to Send in a Report:
- Provide detailed steps in your message explaining how to reproduce the security vulnerability. This should include any links you clicked on, pages you visited, URLs, user IDs, etc. Provide clear descriptions of any accounts used in your report and the relationships between them.
- If you send an image or a video, please:
– Keep it short by showing only the necessary parts.
– Record at a readable resolution.
– Make sure the language of the video is in English to help us quickly identify the problem.
– If a large amount of text appears in your video, please include a copy of the text in your message as well.
– Please keep the video private by uploading it as an attachment.
Rewards for qualifying bugs range from $100 to $20,000 payable via your choice of BitGo supported cryptocurrencies. The following table outlines the usual rewards chosen for the most common classes of bugs:*
|Vulnerabilities giving direct access to BitGo servers:
|Remote code execution
||Command injection, deserialization bugs, sandbox escapes
|Unrestricted file system or database access
||Unsandboxed XXE, SQL injection
|Logic flaw bugs leaking or bypassing significant security controls
||Direct object reference, remote user impersonation
Vulnerabilities giving access to client or authenticated session of the logged-in victim:
|Execute code on the client
||Web: Cross-site scripting; Mobile: Native code execution
|Other valid security vulnerabilities
||Web: CSRF, Clickjacking; Mobile: Information leak, privilege escalation
Vulnerabilities that can cause a denial of service:
|Make BitGo services unavailable
||Subdomain takeover, unmitigated ways to abuse API, lack of ip throttling
* The final amount is always chosen at the discretion of the reward panel. In particular, we may decide to pay higher rewards for unusually clever or severe vulnerabilities; decide to pay lower rewards for vulnerabilities that require unusual user interaction; decide that a single report actually constitutes multiple bugs; or that multiple reports are so closely related that they only warrant a single reward.