Gojek

Gojek is rapidly expanding product offerings to our consumers. This growth is a win for everyone, but we want to ensure that our consumers remain safe on our platform. We take the security of our consumers very seriously and are thus taking steps to ensure we work closely with the broader security community to handle responsible disclosure of any bugs found on our platform.

We look forward to working with the security community to find security vulnerabilities in order to keep our businesses and customers safe.

Program Rules

At Gojek, we recognize the important role that security researchers play in helping to keep Gojek and our customers secure.

By participating in this program you acknowledge that you have read and agreed to the Program Rules, which is defined as this entire document.

Testing Policy and Responsible Disclosure

Please adhere to the following rules while performing research on this program:

• Denial of service (DoS) attacks on Gojek applications, servers, networks or infrastructure are strictly forbidden.
• Avoid tests that could cause degradation or interruption of our services.
• Do not use automated scanners or tools that generate large amount of network traffic.
• Only perform tests against your own accounts to protect our users' privacy.
• Do not leak, manipulate, or destroy any user data or files in any of our applications/servers.
• Do not copy any files from our applications/servers and disclose them.
• No vulnerability disclosure, full, partial or otherwise, is allowed.
• Social engineering (e.g. phishing, vishing, smishing) is prohibited.

Reward Eligibility and Amount

We are happy to thank everyone who submits valid reports which help us improve the security of Gojek, however only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.
• The vulnerability must be a qualifying vulnerability (see below).
• Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
• The report must contain the following elements:
  • Clear textual description of the vulnerability, how it can be exploited, the security impact it has on the application, its users and Gojek, and remediation advice on fixing the vulnerability
  • Submit one vulnerability per-report, unless you need to chain vulnerabilities to provide impact.
  • Proof of exploitation: screenshots and/or videos demonstrating the exploit was performed, and showing the final impact
  • Provide complete steps with the necessary information to reproduce the exploit, including (if necessary) code snippets, payloads, commands etc
• You must not break any of the testing policy rules listed above
• You must not be a former or current employee of Gojek or one of its contractors.
• We have 30 days delay for a CVE in order to be eligible for reward.

Recent CVE 30 Days Delay

To ensure we have reasonable time to patch recently released Common Vulnerabilities and Exposures (CVEs), any vulnerability based on a CVE released within the last 30 days will not be eligible for a bounty until after this period, This delay allows us to adequately assess, test, and deploy patches for newly disclosed vulnerabilities.

Reward amounts

Reward and amount will be decided based on Gojek Security team discretion. We will give our best to assess the vulnerability and use CVSS scoring and actual business impact of the vulnerability upon performing risk analysis.

Third-Party Services

If you believe an issue with one of our third-party service providers is the result of Gojek’s misconfiguration or insecure usage of that service (or you’ve reported an issue affecting many customers of the service that you believe Gojek can temporarily mitigate without stopping usage of the service while a fix is implemented upstream), we’d appreciate your report regarding the issue.

Keep in mind that any reports regarding third-party services are likely to not be eligible for a reward.

Scope

• Valid submissions for the assets in the ‘Scope’ section will be rewarded accordingly in this bug bounty program.

• Please note that we cannot promise you a bounty for valid report submissions that are outside of the in-scope assets. However, in certain exceptional cases, if we decide to reward, the decision will be at our discretion and it won’t probably go higher than a Tier 2 Medium bounty.

Program Owner Discretion

All determinations regarding submitted reports — including but not limited to validity, scope applicability, severity rating, duplicate status, reward eligibility, reward amount, are made solely at the discretion of GoTo Company as the program owner. Researchers acknowledge that GoTo Company's decisions on these matters are final.

In the event of any conflict between this program policy and general guidance provided elsewhere, the rules stated in this program brief apply to participation in this specific program.

Focus Areas

We are happy for you to look over the entire suite of services that our Consumer App offers.
We would, however, be very interested to find out what you can do on our payment platform.

Anything around peer to peer transfer and withdrawal is particularly interesting for us.

Note that you will need an Indonesian phone number to transfer to and from.

Safe Harbor

Any activities in relation to your participation in this program conducted in a manner with full submission and compliance with this Policy Page will be considered authorized conduct and we will not initiate or suggest legal action against you.

If legal action is initiated by a third party against you in connection with your participation in this program, provided that you have fully submitted and complied with this program’s Policy Page, we will make it known that your actions were conducted pursuant to this program and have complied with the Policy Page.

Thank you for helping keep Gojek and our users safe!

FAQ

Q: I want swag, how do I get it?
A: Unfortunately, Gojek does not currently offer any swag.
Q: Can Gojek provide me with a pre-configured test account?
A: As of now, Gojek doesn’t provide any test accounts.
Q: Can we test Gojek Apps outside of the operating country?
A: Yes, we would love to have you participate.