Syfe

{
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 212,
  "average_time_to_first_program_response": 13,
  "average_time_to_report_resolved": 804,
  "handle": "syfe_bbp",
  "id": 0,
  "managed_program": true,
  "name": "Syfe",
  "offers_bounties": true,
  "offers_swag": false,
  "response_efficiency_percentage": 90,
  "submission_state": "open",
  "url": "https://hackerone.com/syfe_bbp",
  "website": "https://syfe.com",
  "targets": {
    "in_scope": [
      {
        "asset_identifier": "alfred-uat-31.nonprod.syfe.com",
        "asset_type": "URL",
        "availability_requirement": "low",
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "The APK provided below is intended solely to support dynamic testing against our trading endpoint alfred-uat-31.nonprod.syfe.com
Please claim the test credentials for assessment.
\n\nAPK :
https://drive.google.com/file/d/1YK6s6P7n8AKioli0FHdTiLYV5ebWgbL7/view?usp=drive_link

\n\nNote:
Static-analysis findings including exported components, manifest misconfigurations, insecure storage patterns, root-detection bypasses, SSL pinning issues, hardcoded secrets, and similar items must be validated against the latest production build.",
        "integrity_requirement": "high",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "alfred.syfe.com",
        "asset_type": "URL",
        "availability_requirement": "high",
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Trading service APIs.",
        "integrity_requirement": "high",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "api-uat-bugbounty.nonprod.syfe.com",
        "asset_type": "URL",
        "availability_requirement": "low",
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "API domain for the test environment.",
        "integrity_requirement": "high",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "api.syfe.com",
        "asset_type": "URL",
        "availability_requirement": "high",
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "API domain for the user services.",
        "integrity_requirement": "high",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "com.syfe",
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "availability_requirement": "medium",
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Syfe android application.",
        "integrity_requirement": "high",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "https://apps.apple.com/sg/app/syfe-stay-invested/id1497156434",
        "asset_type": "APPLE_STORE_APP_ID",
        "availability_requirement": null,
        "confidentiality_requirement": null,
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Syfe IOS application.",
        "integrity_requirement": null,
        "max_severity": "critical"
      },
      {
        "asset_identifier": "mark8.syfe.com",
        "asset_type": "URL",
        "availability_requirement": "high",
        "confidentiality_requirement": "low",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Market data API service.",
        "integrity_requirement": "high",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "uat-bugbounty.nonprod.syfe.com",
        "asset_type": "URL",
        "availability_requirement": "low",
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "The primary test environment for the research is provided. The credentials are only valid for this environment.\nNote: Findings on this environment should be applicable on production.",
        "integrity_requirement": "high",
        "max_severity": "critical"
      },
      {
        "asset_identifier": "www.syfe.com",
        "asset_type": "URL",
        "availability_requirement": "high",
        "confidentiality_requirement": "high",
        "eligible_for_bounty": true,
        "eligible_for_submission": true,
        "instruction": "Main domain for Syfe. \nPlease self sign-up for the accounts only using your ==@wearehackerone.com== address at [https://www.syfe.com/create-account?utm_source=bug_bounty&medium=bug_bounty](https://www.syfe.com/create-account?utm_source=bug_bounty&medium=bug_bounty) to perform any testing on production. \nRefer to non-qualifying bugs and disqualifiers in program guidelines.",
        "integrity_requirement": "high",
        "max_severity": "critical"
      }
    ],
    "out_of_scope": []
  }
}