Supported languages:

• English
• Russian

Scope of the Bug Bounty program:

Domains:

Testing Rules:

We consider reports informational if:

• The report was submitted by a current employee of the RuStore or a former employee who left the company less than one year ago;
• The vulnerability is found in a demo environment, on a domain used for training, or in a related application.

We do not accept or review:

• Reports generated by AI, vulnerability scanners, or other automated tools without a screenshot or video demonstrating the vulnerability and the steps required to reproduce it;
• Disclosure of information that is not confidential, for example, the version of a product;
• Disclosure of information about a user that is public, for example, a user's nickname;
• Bug reports based on the version of a product/protocol (e.g. TLS version);
• Bug reports about a missing security mechanism/current best practice (e.g. missing - CSRF token, framing/clickjacking protection);
• We do not accept disclosures of internal hostnames, IP addresses, or sourcemaps;
• Messages about published and unpublished SPF and DMARC policies;
• Cross-site request forgery leading to logout (logout CSRF);
• Vulnerabilities in partner products or services, unless company users/accounts are directly affected;
• Security of rooted, jailbroken, or otherwise modified devices and applications;
• Vulnerabilities in outdated OS and applications;
• Attacks in which the user independently granted permissions to a malicious application;
• Ability to reverse engineer an application, or the lack of binary protection;
• MitM and local attacks;
• Open redirects, insufficient session validation, handling cookies after logout, etc. are not accepted unless additional vectors are defined (e.g., the ability to steal a session token via a remote vector for open redirects);
• Open redirection vulnerabilities are accepted only if a security impact is identified, such as the possibility of stealing an authorization token;
• Injecting unformatted text, audio, images, or video into a server response outside of the user interface (for example, into JSON data or an error message), unless doing so replaces the user interface, changes the behavior of the user interface, or results in other negative consequences;
• Same site scripting, reflected downloads, and similar attacks with questionable impact;
• CSP-related bug reports;
• IDN homograph attacks;
• XSPA (scanning the IP addresses/ports of external networks);
• Excel CSV formula injection;
• Scripting in PDF documents;
• Attacks that require full access to a local account, browser profile, or physical access to the device;
• Attacks based on scenarios where a vulnerability in a third-party site or application is required as a prerequisite and is not demonstrated;
• Theoretical attacks without proof of feasibility;
• Denial of service (DoS) vulnerabilities, for example - sending a large volume of requests or data (flooding);
• Ability to send a large number of messages;
• Ability to send spam or a malware file (for example, registration or password recovery spam);
• Disclosure of information through external links not controlled by the company (for example, Google dorking of private protected areas of robots.txt);
• Disclosure of unused or properly restricted JS API keys;
• Disclosure of keys or use of an external map service or error tracing service - App Tracer, Sentry, DaData and others;
• Ability to perform an action not available through the user interface and without identified security risks;
• Vulnerabilities associated with the use of phishing and other social engineering techniques;
• Disclosure of /metrics, /status, htaccess or similar without a demonstrated information security threat (for example, disclosure of private API methods, tokens);
• Blind SSRF vulnerabilities without demonstrating a threat to the service's information security in the report;
• EXIF metadata in images;
• SSRF vulnerabilities that involve sending requests via rentgen*.smailru.net, snipster.*.go.mail.ru, mpr*.m.smailru.net, kbt-sand-node*.m.smailru.net, rs-proxy*.i.smailru.net, proxy.oneme.ru or other proxies specifically designed to protect against SSRF;
• Vulnerabilities that disclose only user accounts but not passwords or other personal data (for example, user enumeration).

General Information

Disclosure Policy

Bounty Rules:

Rewards for 3rd party solutions used by VK

Rewards:

Rules for AI Agents