Banco Plata

{
  "id": 0,
  "url": "https://hackerone.com/banco_plata",
  "name": "Banco Plata",
  "handle": "banco_plata",
  "targets": {
    "in_scope": [
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "*.bancoplata.mx",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "*.platacard.mx",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "dif.tech.plata",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "APPLE_STORE_APP_ID",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "id6443932656",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "We are particularly interested in vulnerabilities that could lead to unauthorized access to employee data or HR functions, such as authentication and session management weaknesses, broken access control (including IDOR and horizontal or vertical privilege escalation between employee and HR/admin roles), exposure of personal data through APIs or file handling, injection vulnerabilities, and account takeover scenarios. Findings reachable without authentication, such as exposed endpoints, login bypass, or information disclosure on public pages, are of particular interest.\n\nResearchers should not attempt to access, modify, or exfiltrate real employee data beyond the minimum needed to demonstrate impact. If you gain access to personal information, stop testing, do not retain the data, and report the finding immediately. Social engineering of Plata employees, phishing, and denial-of-service testing are out of scope for this asset.",
        "max_severity": "critical",
        "asset_identifier": "people.plata.team",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "medium",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "Primary public website of Banco Plata, accessible from the internet and used by customers and prospective customers to learn about and access Plata’s banking products and services. As the main public-facing domain of a regulated financial institution, it is treated as a high-value asset, and any compromise of its integrity or the data it handles has direct impact on customer trust.\n\nWe are particularly interested in vulnerabilities that could affect customers or the integrity of the site, such as cross-site scripting, open redirects and other issues that could be abused for phishing, content injection or defacement, broken access control, injection vulnerabilities, exposure of customer or internal data through APIs, forms, or file handling, and security misconfigurations. Findings reachable without authentication, such as exposed endpoints, information disclosure, or leaked credentials and configuration files, are of particular interest.\n\nResearchers should not attempt to access, modify, or exfiltrate real customer data beyond the minimum needed to demonstrate impact. If you gain access to personal or financial information, stop testing, do not retain the data, and report the finding immediately. Social engineering of Plata employees or customers, phishing, and denial-of-service testing are out of scope for this asset.",
        "max_severity": "critical",
        "asset_identifier": "plata.co",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "API",
        "instruction": "We are particularly interested in vulnerabilities that could lead to unauthorized access to customer accounts, data, or banking functions, such as authentication and token handling weaknesses, broken object level authorization (BOLA/IDOR) allowing access to other customers’ data, broken function level authorization, mass assignment, injection vulnerabilities, business logic flaws in banking operations, missing or bypassable rate limiting on sensitive actions, and account takeover scenarios. Issues that can be triggered directly against the API, bypassing controls enforced only on the client side, are of particular interest. Findings reachable without authentication, such as exposed endpoints, information disclosure, or verbose error messages leaking internal details, are also in focus.\n\nResearchers should not attempt to access, modify, or exfiltrate real customer data, or execute real financial operations, beyond the minimum needed to demonstrate impact. If you gain access to personal or financial information, stop testing, do not retain the data, and report the finding immediately. Social engineering of Plata employees or customers, phishing, and denial-of-service testing are out of scope for this asset.",
        "max_severity": "critical",
        "asset_identifier": "prime.plata.co",
        "eligible_for_bounty": true,
        "integrity_requirement": "high",
        "eligible_for_submission": true,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      }
    ],
    "out_of_scope": [
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "https://bancoplata.mx/*/whistleblowing",
        "eligible_for_bounty": false,
        "integrity_requirement": "not_defined",
        "eligible_for_submission": false,
        "availability_requirement": "not_defined",
        "confidentiality_requirement": "not_defined"
      },
      {
        "asset_type": "WILDCARD",
        "instruction": null,
        "max_severity": "none",
        "asset_identifier": "https://platacard.mx/*/whistleblowing",
        "eligible_for_bounty": false,
        "integrity_requirement": "not_defined",
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": "not_defined"
      }
    ]
  },
  "website": "http://bancoplata.mx",
  "offers_swag": false,
  "managed_program": true,
  "offers_bounties": true,
  "submission_state": "open",
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 627,
  "response_efficiency_percentage": 96,
  "average_time_to_report_resolved": 5938,
  "average_time_to_first_program_response": 21
}