Featured on
Featured on
— no diffs detected in snapshot history yet —
No reports yet — be the first to share your triage timing for Infomaniak Bug Bounty program.
// peer-sourced response times. platforms won’t publish this — hunters can. anonymized in aggregate.
{
"id": "infomaniak-bug-bounty-program",
"name": "Infomaniak Bug Bounty program",
"public": true,
"disabled": false,
"managed": null,
"min_bounty": 100,
"max_bounty": 7000,
"targets": {
"in_scope": [
{
"target": "api.infomaniak.com",
"type": "api"
},
{
"target": "login.infomaniak.com",
"type": "web-application"
},
{
"target": "manager.infomaniak.com/v3/*",
"type": "web-application"
},
{
"target": "shop.infomaniak.com",
"type": "web-application"
},
{
"target": "ksuite.infomaniak.com",
"type": "web-application"
},
{
"target": "*.kdrive.infomaniak.com",
"type": "web-application"
},
{
"target": "swiss-backup*.infomaniak.com",
"type": "web-application"
},
{
"target": "www.infomaniak.com",
"type": "web-application"
},
{
"target": "*.kchat.infomaniak.com",
"type": "web-application"
},
{
"target": "calendar.infomaniak.com",
"type": "web-application"
},
{
"target": "chk.infomaniak.com",
"type": "web-application"
},
{
"target": "contacts.infomaniak.com",
"type": "web-application"
},
{
"target": "etickets.infomaniak.com",
"type": "web-application"
},
{
"target": "kmeet.infomaniak.com",
"type": "web-application"
},
{
"target": "kpaste.infomaniak.com",
"type": "web-application"
},
{
"target": "mail.infomaniak.com",
"type": "web-application"
},
{
"target": "player-radio.infomaniak.com",
"type": "web-application"
},
{
"target": "storage*.infomaniak.com",
"type": "web-application"
},
{
"target": "sync.infomaniak.com",
"type": "web-application"
},
{
"target": "swisstransfer.infomaniak.com",
"type": "web-application"
},
{
"target": "vod.infomaniak.com",
"type": "web-application"
},
{
"target": "*.vod2.infomaniak.com",
"type": "web-application"
},
{
"target": "welcome.infomaniak.com",
"type": "web-application"
},
{
"target": "www.swisstransfer.com",
"type": "web-application"
},
{
"target": "euria.infomaniak.com",
"type": "web-application"
},
{
"target": "https://play.google.com/store/apps/details?id=com.infomaniak.drive",
"type": "mobile-application-android"
},
{
"target": "https://apps.apple.com/app/infomaniak-kdrive/id1482778676",
"type": "mobile-application-ios"
},
{
"target": "https://github.com/Infomaniak/desktop-kDrive",
"type": "application"
},
{
"target": "https://play.google.com/store/apps/details?id=com.infomaniak.mail",
"type": "mobile-application-android"
},
{
"target": "https://apps.apple.com/fr/app/infomaniak-mail/id1622596573",
"type": "mobile-application-ios"
},
{
"target": "https://play.google.com/store/apps/details?id=com.infomaniak.auth",
"type": "mobile-application-android"
},
{
"target": "https://apps.apple.com/fr/app/infomaniak-authenticator/id1478424817",
"type": "mobile-application-ios"
},
{
"target": "kdrive.infomaniak.com/app/*/preview/*",
"type": "web-application"
},
{
"target": "kdrive.infomaniak.com/app/office*/*",
"type": "web-application"
},
{
"target": "ksuite.infomaniak.com/*/kdrive/*/preview/*",
"type": "web-application"
},
{
"target": "infomaniak.events",
"type": "web-application"
},
{
"target": "hosting-ik.com",
"type": "web-application"
},
{
"target": "ix2smbdyjt.infomaniak.site",
"type": "web-application"
},
{
"target": "5k8vrbdyje.infomaniak.site",
"type": "web-application"
},
{
"target": "fv3lfbdyjh.infomaniak.site",
"type": "web-application"
},
{
"target": "l75pvbdyjo.infomaniak.site",
"type": "web-application"
},
{
"target": "https://play.google.com/store/apps/details?id=com.infomaniak.chat",
"type": "mobile-application-android"
},
{
"target": "https://apps.apple.com/fr/app/infomaniak-kchat/id6443845553",
"type": "mobile-application-ios"
},
{
"target": "https://play.google.com/store/apps/details?id=com.infomaniak.euria",
"type": "mobile-application-android"
},
{
"target": "https://apps.apple.com/fr/app/infomaniak-euria/id6754152858",
"type": "mobile-application-ios"
},
{
"target": "https://play.google.com/store/apps/details?id=com.infomaniak.swisstransfer",
"type": "mobile-application-android"
},
{
"target": "https://apps.apple.com/fr/app/infomaniak-swisstransfer/id6737686335",
"type": "mobile-application-ios"
},
{
"target": "https://play.google.com/store/apps/details?id=com.infomaniak.sync",
"type": "mobile-application-android"
},
{
"target": "*.infomaniak.com",
"type": "web-application"
},
{
"target": "api.pub1.infomaniak.cloud",
"type": "web-application"
},
{
"target": "api.pub2.infomaniak.cloud",
"type": "web-application"
}
],
"out_of_scope": [
{
"target": "Assets not listed in the in scope section are to be considered as out of the scope of this program and won't be eligible for reward",
"type": "other"
},
{
"target": "We do not manage Open Stack dashboard which is therefore out of scope",
"type": "other"
},
{
"target": "ov-XX.infomaniak.ch and od-XX.infomaniak.ch sub domains",
"type": "other"
},
{
"target": "This domain https://drive.infomaniak.com/app/office/:folder:/:file: is out of scope. This is only office application, an external app to open MS office documents.",
"type": "other"
},
{
"target": "FTP credentials from our customers, like *.ftp.infomaniak.com",
"type": "other"
},
{
"target": "VPS instances from our customers, like *.vps.infomaniak.com",
"type": "other"
},
{
"target": "MySQL credentials from our customers, like *.myd.infomaniak.com",
"type": "other"
},
{
"target": "Jelastic subdomains : *.jcloud.ik-server.com, *.jpc.infomaniak.com, *.jpe.infomaniak.com",
"type": "other"
},
{
"target": "User email verification",
"type": "other"
},
{
"target": "Websocket IPS-public credentials (MQTT, info-mq, IPS_RABBIT, ips-public). Public identifiers that do not allow access to information outside the scope of the user's profile.",
"type": "other"
},
{
"target": "S3 credentials from our customers, like s3.pub*.infomaniak.cloud",
"type": "other"
},
{
"target": "Database service instances from customers, like *.dbaas.infomaniak.cloud",
"type": "other"
},
{
"target": "acronis.infomaniak.com",
"type": "other"
},
{
"target": "partner program : pages about finding partner and sending offer / All routes ending with /partners/tender",
"type": "other"
},
{
"target": "storage*.infomaniak.com/newsletter/thumbnails/*",
"type": "other"
},
{
"target": "Information returned by /get-tickets-infos (including organizer, event_name, event_date, command_date, and masked email) is out of scope",
"type": "other"
},
{
"target": "Moving or copying calendar events / contacts between containers by read-write collaborators (intended behavior)",
"type": "other"
}
]
}
}login.infomaniak.commanager.infomaniak.com/v3/*shop.infomaniak.comksuite.infomaniak.comswiss-backup*.infomaniak.comwww.infomaniak.comcalendar.infomaniak.comchk.infomaniak.comcontacts.infomaniak.cometickets.infomaniak.complay.google.com/store/apps/details?id=com.infomaniak.driveplay.google.com/store/apps/details?id=com.infomaniak.mailplay.google.com/store/apps/details?id=com.infomaniak.authplay.google.com/store/apps/details?id=com.infomaniak.chatplay.google.com/store/apps/details?id=com.infomaniak.euriaplay.google.com/store/apps/details…=com.infomaniak.swisstransferplay.google.com/store/apps/details?id=com.infomaniak.syncapps.apple.com/app/infomaniak-kdrive/id1482778676apps.apple.com/fr/app/infomaniak-mail/id1622596573apps.apple.com/fr/app/infomaniak-authenticator/id1478424817apps.apple.com/fr/app/infomaniak-kchat/id6443845553apps.apple.com/fr/app/infomaniak-euria/id6754152858apps.apple.com/fr/app/infomaniak-swisstransfer/id6737686335Assets not listed in the in scope … won't be eligible for rewardotherWe do not manage Open Stack dashbo…ich is therefore out of scopeotherov-XX.infomaniak.ch and od-XX.infomaniak.ch sub domainsotherThis domain https://drive.infomani… to open MS office documents.otherFTP credentials from our customers, like *.ftp.infomaniak.comotherVPS instances from our customers, like *.vps.infomaniak.comotherMySQL credentials from our customers, like *.myd.infomaniak.comotherJelastic subdomains : *.jcloud.ik-…iak.com, *.jpe.infomaniak.comotherUser email verificationotherWebsocket IPS-public credentials (… scope of the user's profile.otherS3 credentials from our customers, like s3.pub*.infomaniak.cloudotherDatabase service instances from cu…like *.dbaas.infomaniak.cloudotheracronis.infomaniak.comotherpartner program : pages about find… ending with /partners/tenderotherstorage*.infomaniak.comstorage*.infomaniak.com/newsletter/thumbnails/*otherInformation returned by /get-ticke…masked email) is out of scopeotherMoving or copying calendar events …aborators (intended behavior)other