avatar
Bug bounty
Public

ATG Public Bug Bounty Program

ATG is the gaming company that knows horse racing. The company was founded in 1974 with the mission to safeguard the long-term development of trotting and thoroughbred racing by offering responsible gambling. ATG has provided quality excitement and entertainment to the Swedish people since the first bet was placed. The company intends to continue doing so. Our vision is to deliver the world’s best gaming experiences. Our offering is: exciting gaming experiences in a fair and convenient manner.

Reward

Bounty
Hall of fame
€0
Low
€100
Medium
€500
High
€1,500
Critical
€4,000

Program

Avg reward
-
Max reward
-
Scopes
7
Supported languages
English

Hacktivity

Reports
463
1st response
< 1 day
Reports last 24h
4
Reports last week
30
Reports this month
44

⚠️ Rate limiting ⚠️

Remember to rate limit your test tools to max 10 requests per second.

About

ATG (AB Trav och Galopp) is the gaming company that knows horse racing. The company was founded in 1974 with the mission to safeguard the long-term development of trotting and thoroughbred racing by offering responsible gambling. ATG has provided quality excitement and entertainment to the Swedish people since the first bet was placed. The company intends to continue doing so. Our vision is to deliver the world’s best gaming experiences. Our offering is: exciting gaming experiences in a fair, convenient and secure manner.

We are committed to work with security experts, such as yourself from all over the world to stay up to date and safeguard our customers, partners and employees. If you discovery a vulnerability that we should know about, do not hesitate and let us know.

We share your passion for security and appreciate your work!

Our rules

  • We will respond as quickly as possible and keep you updated throughout the process
  • We will not take legal actions against you if you follow the rules and scopes
  • We will be fair and evaluate submissions according to realistic scenarios
  • We reserve the right to cancel this Bug Bounty Program or change its scope at any time
  • The decision to pay a reward is at our discretion

Your rules

We appreciate your work, knowledge and passion for security. We are happy to work with everyone who submits valid reports to help improve our security. With that said, only those that meet the following eligibility requirements may receive monetary reward.

  • Rate limiting of automatic testing tools to a maximum of 10 requests per second
  • Disclosure of the vulnerability report is made exclusively through YWH
  • The report shall include a clear description including the steps to reproduce the vulnerability together with necessary attachments such as screenshots, proof of concept code or similar
  • You need to be the first person to report an unknown issue
  • You need to report any vulnerability found not later than 24 hours after discovery
  • You are not allowed to perform any type of Denial of Service attack or tests that could cause degradation or interruption of our service
  • You are not allowed to leak, manipulate or destroy any user data
  • You are not allowed to publicly disclose a bug before it has been fixed
  • You are not allowed to attempt non-technical attacks such as social engineering, phishing, etc
  • You are only allowed to test against accounts you own yourself
  • You must not be a former or current ATG employee/contractor

Sometimes our teams are already aware and working on a vulnerability before you reported it. In that case we will recognize your work and thank you but the report will not be eligible for a reward.

Note that disclosing details, conversations or other information that have negative impact on the program or ATG brand will result in immediate disqualification from the program.

Scope

Only defined scopes are eligible for rewards. However.. Serious vulnerabilities reported on out of scope assets is currently not eligible for monetary rewards but we will try to set you up with some "cool merch" as thank you if your report result in changes on our side and evaluate to adjust our scope for the future.

Reward

Asset value CVSS
Low
 CVSS
Medium
 CVSS
High
 CVSS
Critical
Critical
€100€500€1,500€4,000
Low
€100€300€1,000€3,000

Systemic issues

1st report100%
2nd report100%
3rd report75%
4th report50%
5th report25%
6th+ report10%

We appreciate all valid reports submitted to our program that enhance our security. However, please note that if a similar issue (see definition in 'More info') has already been reported, by you or any other hunter, the reward will be decreasing according to these percentages.

Scopes

ScopeTypeAsset value
*.atg.se
 Other
Low
Low
€100
Medium
€300
High
€1,000
Critical
€3,000
www.atg.se
 Web application
Critical
Low
€100
Medium
€500
High
€1,500
Critical
€4,000
api.atg.se
 API
Critical
Low
€100
Medium
€500
High
€1,500
Critical
€4,000
iam.atg.se
 Web application
Critical
Low
€100
Medium
€500
High
€1,500
Critical
€4,000
https://apps.apple.com/se/app/atg/id1434660322
 Mobile application IOS
Low
Low
€100
Medium
€300
High
€1,000
Critical
€3,000
https://apps.apple.com/se/app/atg-live/id1608156355
 Other
Low
Low
€100
Medium
€300
High
€1,000
Critical
€3,000
https://play.google.com/store/apps/details?id=se.atg.live&hl=en&gl=SE
 Mobile application Android
Low
Low
€100
Medium
€300
High
€1,000
Critical
€3,000

Out of scopes

  • fraga.atg.se (external supplier)
  • hittabutik.atg.se (external supplier)
  • kundo.atg.se (external supplier)
  • shop.atg.se (external supplier)
  • r124.news.atg.se (external supplier)
  • r123.news.atg.se (external supplier)
  • r122.news.atg.se (external supplier)
  • r121.news.atg.se (external supplier)
  • webbshop.atg.se (external supplier)

Vulnerability types

Qualifying vulnerabilities

  • SQL Injection (SQLi)
  • Cross-Site Scripting (XSS)
  • Remote Code Execution (RCE)
  • Insecure Direct Object Reference (IDOR)
  • Horizontal and vertical privilege escalation
  • Authentication bypass & broken authentication
  • Business Logic Errors vulnerability with real security impact
  • Local files access and manipulation (LFI, RFI, XXE, SSRF, XSPA)
  • Cross-Origin Resource Sharing (CORS) with real security impact
  • Cross-site Request Forgery (CSRF) with real security impact
  • Open Redirect
  • Exposed secrets, credentials or sensitive information on an asset under our control and affecting at least one of our scopes
  • Reproducible game manipulation and/or cheating

Non-qualifying vulnerabilities

  • Broken Link/Social media Hijacking
  • Tabnabbing
  • Missing cookie flags
  • Content/Text injections
  • Clickjacking/UI redressing
  • Denial of Service (DoS) attacks
  • Recently disclosed 0-day vulnerabilities (less than 30 days sinces patch release)
  • CVEs without exploitable vulnerabilities and PoC
  • Open ports or services without exploitable vulnerabilities and PoC
  • Social engineering of staff or contractors
  • Presence of autocomplete attribute on web forms
  • Vulnerabilities affecting outdated browsers or platforms
  • Self-XSS or XSS that cannot be used to impact other users
  • Any hypothetical flaw or best practices without exploitable vulnerabilities and PoC
  • SSL/TLS issues (e.g. expired certificates, best practices)
  • Unexploitable vulnerabilities (e.g. Self-XSS, XSS or Open Redirect through HTTP headers...)
  • Reports with attack scenarios requiring MITM or physical access to victim's device
  • Missing security-related HTTP headers which do not lead directly to an exploitable vulnerability and PoC
  • Low severity Cross-Site Request Forgery (CSRF) (e.g. Unauthenticated / Logout / Login / Products cart updates...)
  • Invalid or missing email security records (e.g. SPF, DKIM, DMARC)
  • Session management issues (e.g. lack of expiration, no logout on password change, concurrent sessions)
  • Disclosure of information without exploitable vulnerabilities and PoC (e.g. stack traces, path disclosure, directory listings, software versions, IP disclosure, 3rd party secrets, EXIF Metadata, Origin IP)
  • CSV injection
  • Malicious file upload (e.g. EICAR files, .EXE)
  • HTTP Strict Transport Security Header (HSTS)
  • Subdomain takeover without a full exploitable vulnerability and PoC or not applicable to the scope
  • Blind SSRF without exploitable vulnerabilities and PoC (e.g. DNS & HTTP pingback, Wordpress XMLRPC)
  • Lack or bypass of rate-limiting, brute-forcing or captcha issues
  • User enumeration (e.g. email, alias, GUID, phone number, common CMS endpoints)
  • Weak password policies (e.g. length, complexity, reuse)
  • Ability to spam users (email / SMS / direct messages flooding)
  • Disclosed or misconfigured public API keys (e.g. Google Maps, Firebase, analytics tools...)
  • Password reset token sent via HTTP referer to external services (e.g. analytics / ads platforms)
  • Stolen secrets, credentials or information gathered from a third-party asset that we have no control over
  • Exposed secrets, credentials or information on an asset under our control that are not applicable to the program’s scope
  • Pre-account takeover (e.g. account creation via oAuth)
  • GraphQL Introspection is enabled
  • Task Hijacking
  • Crashing your own application on mobile device
  • Lack of client-side protections on mobile binaries: SSL pinning/binary protection/code obfuscation/jailbreak detection/root detection/anti-debugging controls/ etc
  • Lack of encryption on internal databases/preference files on mobile device
  • Exploits that are only possible on Android versions that are not currently supported at the time of the emission of the vulnerability report
  • Exploits that are only possible on IOS versions that are not currently supported at the time of the emission of the vulnerability report
  • Exploits that are only possible on a jailbroken/rooted device
  • Generic Android or iOS vulnerabilities

Reports of leaks and exposed credentials

In the context of this program, we do not intend to encourage, accept or reward reports of leaks that are not applicable to our program’s scope and policy. To summarize our policy, you may refer to the below table:

Type of leak
Source of leak is in-scope
Source of leak belongs to the Organization and is out-of-scope
Source of leak does not belong to the Organization and is out-of-scope
Impact is in-scope (e.g. valid credentials on an in-scope asset)
checked Eligible
checked Eligible
checked Not eligible
Impact is out-of-scope (e.g. valid credentials for an out-of-scope asset)
checked Eligible
checked Not eligible
checked Not eligible

Hunters collaboration

When submitting new report, you can add up to 5 collaborators, and define the reward split ratio.

For more information, see help center.
Note: For reports that have already been rewarded, it is not possible to redistribute the rewards.

To submit a vulnerability report, you need to login with your hunter account.
program thumbnail
To submit a vulnerability report, you need to login with your hunter account.