Infomaniak Bug Bounty program

{
  "id": "infomaniak-bug-bounty-program",
  "name": "Infomaniak Bug Bounty program",
  "public": true,
  "managed": null,
  "targets": {
    "in_scope": [
      {
        "type": "web-application",
        "target": "login.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "manager.infomaniak.com/v3/*"
      },
      {
        "type": "web-application",
        "target": "shop.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "ksuite.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "*.kdrive.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "swiss-backup*.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "www.infomaniak.com"
      },
      {
        "type": "api",
        "target": "api.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "*.kchat.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "calendar.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "chk.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "contacts.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "etickets.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "kmeet.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "kpaste.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "mail.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "player-radio.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "storage*.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "sync.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "swisstransfer.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "vod.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "*.vod2.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "welcome.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "www.swisstransfer.com"
      },
      {
        "type": "web-application",
        "target": "euria.infomaniak.com"
      },
      {
        "type": "mobile-application-android",
        "target": "https://play.google.com/store/apps/details?id=com.infomaniak.drive"
      },
      {
        "type": "mobile-application-ios",
        "target": "https://apps.apple.com/app/infomaniak-kdrive/id1482778676"
      },
      {
        "type": "application",
        "target": "https://github.com/Infomaniak/desktop-kDrive"
      },
      {
        "type": "mobile-application-android",
        "target": "https://play.google.com/store/apps/details?id=com.infomaniak.mail"
      },
      {
        "type": "mobile-application-ios",
        "target": "https://apps.apple.com/fr/app/infomaniak-mail/id1622596573"
      },
      {
        "type": "mobile-application-android",
        "target": "https://play.google.com/store/apps/details?id=com.infomaniak.auth"
      },
      {
        "type": "mobile-application-ios",
        "target": "https://apps.apple.com/fr/app/infomaniak-authenticator/id1478424817"
      },
      {
        "type": "web-application",
        "target": "kdrive.infomaniak.com/app/*/preview/*"
      },
      {
        "type": "web-application",
        "target": "kdrive.infomaniak.com/app/office*/*"
      },
      {
        "type": "web-application",
        "target": "ksuite.infomaniak.com/*/kdrive/*/preview/*"
      },
      {
        "type": "web-application",
        "target": "infomaniak.events"
      },
      {
        "type": "web-application",
        "target": "hosting-ik.com"
      },
      {
        "type": "web-application",
        "target": "ix2smbdyjt.infomaniak.site"
      },
      {
        "type": "web-application",
        "target": "5k8vrbdyje.infomaniak.site"
      },
      {
        "type": "web-application",
        "target": "fv3lfbdyjh.infomaniak.site"
      },
      {
        "type": "web-application",
        "target": "l75pvbdyjo.infomaniak.site"
      },
      {
        "type": "application",
        "target": "https://github.com/Infomaniak/desktop-kChat"
      },
      {
        "type": "mobile-application-android",
        "target": "https://play.google.com/store/apps/details?id=com.infomaniak.chat"
      },
      {
        "type": "mobile-application-ios",
        "target": "https://apps.apple.com/fr/app/infomaniak-kchat/id6443845553"
      },
      {
        "type": "mobile-application-android",
        "target": "https://play.google.com/store/apps/details?id=com.infomaniak.euria"
      },
      {
        "type": "mobile-application-ios",
        "target": "https://apps.apple.com/fr/app/infomaniak-euria/id6754152858"
      },
      {
        "type": "mobile-application-android",
        "target": "https://play.google.com/store/apps/details?id=com.infomaniak.swisstransfer"
      },
      {
        "type": "mobile-application-ios",
        "target": "https://apps.apple.com/fr/app/infomaniak-swisstransfer/id6737686335"
      },
      {
        "type": "mobile-application-android",
        "target": "https://play.google.com/store/apps/details?id=com.infomaniak.sync"
      },
      {
        "type": "wildcard",
        "target": "*.infomaniak.com"
      },
      {
        "type": "web-application",
        "target": "manager.infomaniak.com/*proxy*"
      },
      {
        "type": "api",
        "target": "api.pub1.infomaniak.cloud"
      },
      {
        "type": "api",
        "target": "api.pub2.infomaniak.cloud"
      },
      {
        "type": "api",
        "target": "s3.gva2.infomaniak.cloud"
      },
      {
        "type": "api",
        "target": "s3.gva1.infomaniak.cloud"
      }
    ],
    "out_of_scope": [
      {
        "type": "other",
        "target": "Assets not listed in the in scope section are to be considered as out of the scope of this program and won't be eligible for reward"
      },
      {
        "type": "other",
        "target": "We do not manage Open Stack dashboard which is therefore out of scope"
      },
      {
        "type": "other",
        "target": "ov-XX.infomaniak.ch and od-XX.infomaniak.ch sub domains"
      },
      {
        "type": "other",
        "target": "This domain https://drive.infomaniak.com/app/office/:folder:/:file: is out of scope. This is only office application, an external app to open MS office documents."
      },
      {
        "type": "other",
        "target": "FTP credentials from our customers, like *.ftp.infomaniak.com"
      },
      {
        "type": "other",
        "target": "VPS instances from our customers, like *.vps.infomaniak.com"
      },
      {
        "type": "other",
        "target": "MySQL credentials from our customers, like *.myd.infomaniak.com"
      },
      {
        "type": "other",
        "target": "Jelastic subdomains : *.jcloud.ik-server.com, *.jpc.infomaniak.com, *.jpe.infomaniak.com"
      },
      {
        "type": "other",
        "target": "User email verification"
      },
      {
        "type": "other",
        "target": "Websocket IPS-public credentials (MQTT, info-mq, IPS_RABBIT, ips-public). Public identifiers that do not allow access to information outside the scope of the user's profile."
      },
      {
        "type": "other",
        "target": "S3 credentials from our customers, like s3.pub*.infomaniak.cloud"
      },
      {
        "type": "other",
        "target": "Database service instances from customers, like *.dbaas.infomaniak.cloud"
      },
      {
        "type": "other",
        "target": "acronis.infomaniak.com"
      },
      {
        "type": "other",
        "target": "Partner program: pages about finding partner and sending offer, and reports about data already public on the partner directory are not eligible. Missing authorization on partner-program routes exposing private data remains in scope."
      },
      {
        "type": "other",
        "target": "storage*.infomaniak.com/newsletter/thumbnails/*"
      },
      {
        "type": "other",
        "target": "Information returned by /get-tickets-infos (including organizer, event_name, event_date, command_date, and masked email) is out of scope"
      },
      {
        "type": "other",
        "target": "Moving or copying calendar events / contacts between containers by read-write collaborators (intended behavior)"
      }
    ]
  },
  "disabled": false,
  "max_bounty": 7000,
  "min_bounty": 100
}