🚝 Introduction

SNCF Connect is a website and application offering an all-in-one mobility service. It is used for buying tickets (trains, urban transports, buses, etc.), for searching itineraries or for checking passenger information you need during your trip: e-tickets, real-time timetables, live traffic information, etc. With more than 1.3 billion visits and 209 million tickets sold in 2023, SNCF Connect makes it possible to manage end-to-end travel. SNCF Connect is one of the first e-commerce website in France for mobilities.

The security of our applications is fundamental for the trust of our clients and partners.

We are happy to offer a way for the security community to help us find and fix vulnerabilities on our applications and we are proud to invite skilled hunters to assist us in identifying vulnerabilities and strengthen our security.

Our bug bounty program is a crucial element of our security strategy.

The main scope of this program is our commercial website and our mobile application's web services.

Thank you for your consideration of our program.

📕Program Rules

The bug bounty program is strictly limited by the scope defined in this program.

SNCF Connect reserves the right to modify the terms of this program or terminate this program at any time.

Out of scope reports will not be accepted.

Following actions are prohibited:

• Disturb, degrade or break access to our services.
• Launch denial of services or any action that can overload our system (like bruteforce)
• Test assets that are not in the scope
• Modify or destroy information (back or front)
• Access, download or modify (or attempt to access, download or modify) data from an account that does not belong to you
• Launch phishing or spear phishing attack against our employees or suppliers
• Engage into physical attack against the datacenters or against SNCF Connect offices

You must not be a former or current employee of SNCF Connect or one of its contractors.

Failure to comply with the preceding rules will result in the rejection of your report.

Please refrain from using automated tools. Limit yourself about 10 requests per second if you do use automated tools.

🚦 Eligibility and Responsible Disclosure

We are happy to reward everyone who submits valid reports which help us improve the security of SNCF Connect.

However, only reports that meet the following eligibility requirements may receive a monetary reward :

• You must be the first reporter of a vulnerability
• The report should include a clear explanation of the impact of the vulnerability's exploitation
• You must send a clear textual description of the report along with steps to reproduce the issue, including attachments such as screenshots or proof of concept code as necessary
• The vulnerability must be a qualifying vulnerability and must not be a non-qualifying vulnerability (see below)
• Any vulnerability found must be reported exclusively through yeswehack.com
• You must not let the public know about a vulnerability without agreement from SNCF Connect

In case of sensitivie information leak :

• DO NOT include Personally Identifiable Information (PII) in your report and please REDACT/OBFUSCATE the PII that is part of your PoC (screenshot, server response, JSON file, etc.) as much as possible
• In case of exposed credentials or secrets, limit yourself to verifying the credentials validity
• DO NOT extract/copy every document or data that is exposed and limit yourself to describe and list what is exposed.

Also, in order not to encourage dark and grey economies, in particular the purchase, resale and trade of identifiers or stolen information, as well as all types of dangerous behavior (e.g. social engineering, ...), we will not accept or reward any report based on information whose source is not the result of failure on the part of our organization or one of our employees/service providers. This excludes, but is not limited to:

• Stolen credentials gathered from unidentified sources (e.g. …)
• Exposed credentials that are not applicable on the program’s scope
• Exposed GitHub/GitLab (or similar) instance with no direct relation with our program’s scope
• Exposed secrets (e.g. API tokens/keys or other technical credentials) that are not directly related to the program’s scope
• Exposed PII on an out-of-scope asset

Failure to comply with the preceding rules will result in the rejection of your report.

💡Good to note

You are testing on a production environment, this means that you will be booking real tickets and travels, with actual payments and transactions. Nonetheless, if you want to try the whole payment process without being charged, you can take a trip refundable in several months, thus you could easily get your refund after your tests.