The scope of the bug bounty program is limited to technical vulnerabilities in the company's services. If you discover other issues that are not security-related, please contact the support team.

Reports submitted by current or former employees (within one year after termination of employment) of YooMoney are accepted but are not eligible for a monetary reward.

Participants are required to keep the information about the discovered vulnerabilities confidential. Disclosure of such information is only permitted with prior written consent from YooMoney.

Participation in this program implies that you have read the program rules and you agree to them. Violations of the rules or other program terms may result in disqualification from receiving a reward.

### RESPONSE TIME
We aim to meet the following response targets:
- Response time (from the moment information is received): up to 5 business days.
- Report processing time (from the moment all information on the report is received): up to 10 business days.
- Reward payment time (from the moment the report is processed): up to 20 business days.

Response times may be extended during national public holidays or periods of high workload. We will keep you informed of our progress at each stage of the process and will notify you if delays occur.

### SCOPE
You may search for vulnerabilities on the following web resources:
- *.yoomoney.ru
- *.yookassa.ru
- *.yoobusiness.ru

And in the following company mobile applications:
- YooMoney Wallet for Android: https://promo.yoomoney.ru/app
- YooKassa for Android: https://promo.yookassa.ru/app

### PRIORITY VULNERABILITIES
Our highest priority is the identification of critical server-side vulnerabilities. However, we are open to considering reports on any vulnerabilities that could negatively impact our company and its operation. Before preparing a report, we recommend reviewing common categories of vulnerabilities we are interested in.

Note that there is also a list of vulnerability types that are not eligible for a reward under this program.

Below is a list of examples for vulnerabilities that are eligible for a reward:
- Remote Code Execution (RCE);
- Injection vulnerabilities (for example, SQL or XML injection);
- LFR / LFI / RFI (Local File Read / Local File Inclusion / Remote File Inclusion);
- SSRF (Server-Side Request Forgery);
- Authentication/authorization flaws;
- IDOR (Insecure Direct Object References);
- Account takeover;
- Business logic flaws;
- Access control vulnerabilities;
- Exposure of sensitive information;
- XSS (Cross-Site Scripting) and CSRF (Cross-Site Request Forgery) that affect sensitive data.

### VULNERABILITIES NOT ELIGIBLE FOR REWARD
We only accept reports containing information about real security issues. Below are examples that are excluded from our program and are not eligible for monetary reward.

**General exclusions:**
- Issues and bugs that are not security-related;
- Reports about vulnerabilities in services that are not operated by YooMoney;
- Reports based on a product/protocol version with no demonstration of a real exploitability;
- 0-day or 1-day vulnerabilities that have been publicly disclosed less than 7 days ago;
- Phishing, social engineering, and scenarios that require physical access to a user’s device;
- Reports about fraud schemes or misuse of legitimate YooMoney functionality;
- Disclosure of technical or non-sensitive information (for example, product versions, used software, stacktrace);
- Raw reports from scanners and other automated tools;
- Information about IP addresses, DNS records and open ports;
- Vulnerabilities that require a complex or unlikely user interaction to exploit;
- Improbable or theoretical attacks without proof of possibility;
- Attacks that require performing MITM or physical proximity on another user's connection (e.g., NFC, Bluetooth, Wi‑Fi attacks, shoulder surfing);
- Reports about weaknesses related to 4–6 digit codes.

**Web application exclusions:**
- Self-XSS, XSS in unpopular or outdated browsers, Flash-based XSS;
- CSRF and XSS without impact on confidential data;
- Open Redirect without an additional attack vector;
- Attacks requiring full access to a local account or browser;
- Self-inflicted content changes on a page ;
- Tabnabbing;
- Full Path Disclosure;
- Clickjacking;
- Absence of Best security practices ;
- Non-compliance with best practices in email configuration;
- Reports related to CSP policy configuration;
- Insecurely configured TLS or SSL;
- Ability to send unlimited text messages and emails;
- Rate-limit vulnerabilities or brute-force attacks on unauthenticated resources;
- Bypassing brute-force protection mechanisms;
- DOS attacks related to sending large numbers of requests or data;
- Disclosure of the existence of a username, email, or phone number in the system;
- Reports about publicly accessible login panels;
- Reports about public availability of https://repo.yoomoney.ru/, https://git.yoomoney.ru/  
* Source code and binary frameworks hosted in these repositories are intended for public access. Reports about disclosure of information in these repositories will be accepted only if secrets (passwords, private keys, tokens, etc.) are discovered.
- Disclosure of limited API keys in JS code.

**Mobile application exclusions:**
- Possibility of decompiling/reversing the mobile app, Frida injections, code modifications
- Bypassing root and jailbreak checks
- Tapjacking
- Task hijacking
- Exported activities, receivers, services discovery unless it leads to unauthorized access
- Screenshots with sensitive information from the app
- Absence of SSL pinning
- Vulnerabilities that require malware, root, or jailbreak
- Disclosure of non-sensitive information on the device
- Requesting excessive permissions
- Absence of protective flags in native libraries
- Vulnerabilities in dependencies without direct impact
- Disclosure of API keys that do not lead to user data leakage or financial loss
- Use of weak cryptography/protection measures

### REPORT FORMAT
Each report should describe a single vulnerability, except for cases where vulnerabilities are related or can be combined into a chain.

Failure to meet the minimum report requirements may reduce the reward amount up to the denial of payment in case the report does not contain enough information for verification. 

All information about the discovered vulnerability (including attachments) must be kept solely within the report. Publishing such information on external resources is prohibited.

A report must include:
- Description of the vulnerability
- Type of vulnerability discovered
- URL of the vulnerable application
- Steps to reproduce (with sample requests)
- Screenshots or video confirming the vulnerability
- Severity analysis
- Remediation recommendations

### RULES
**TESTING RULES**
- Use only your own accounts or accounts of users who have explicitly given consent for testing. Do not attempt to access any confidential information or accounts that belong to other people;
- Any activity that may damage the company’s applications, infrastructure, customers or partners is prohibited;
- For proof-of-concept purposes, use the minimal actions necessary to confirm a vulnerability. If testing may affect other users or system availability, contact us for permission. Further exploitation of vulnerabilities is strictly forbidden;
- Social engineering directed at YooMoney employees, partners, contractors or users is prohibited;
- Physical attacks against the company or its infrastructure are prohibited;
- Exploitation of vulnerabilities after testing is complete is prohibited;
- Automated scanning must be limited to 5 requests per second.


**RCE Testing Policy**
Testing for vulnerabilities that may lead to remote code execution must comply with this policy.
Only actions allowed to be performed on servers during testing:
- Executing commands: ifconfig (ipconfig), hostname, whoami;
- Reading files: "/etc/passwd" and "/proc/sys/kernel/hostname" (or "drive:/boot.ini", "drive:/install.ini");
- Creating an empty file in the current user's working directory.
Any other actions require prior approval from the YooMoney security team.

**SQL Injection Testing Policy**
Testing for vulnerabilities that may allow SQL injection must comply with this policy.
During testing, only the following actions are allowed:
- Retrieving information about the current database (SELECT database()), its version (SELECT @@version), current user (SELECT user(), SELECT system_user()), or host name (SELECT @@hostname);
- Retrieving database scheme (SELECT table_schema), list of tables (SELECT table_name), and column names (SELECT column_name).
Any other actions require prior approval from the YooMoney security team.

**File Upload and Read Policy**
Testing for vulnerabilities that may allow arbitrary file read or arbitrary file upload must comply with this policy.
Prohibited actions when uploading files:
- Modifying, changing, deleting, or replacing any files on the server (including system files), except files associated with the researcher’s account or with a user account that has explicitly given consent, provided this does not disrupt the service or its parts;
- Uploading files that could cause denial of service (for example, very large files or a very large number of files);
- Uploading malicious files (for example, malware or spyware).

If arbitrary file reading is possible, the following actions are allowed:
- Reading only these files:"/etc/passwd" and "/proc/sys/kernel/hostname" (or "drive:/boot.ini", "drive:/install.ini").
Any other actions require prior approval from the YooMoney security team.

### DISCLOSURE RULES
- Disclosure of discovered vulnerabilities or any information regarding the report without written permission from the YooMoney security team is prohibited;
- Submit reports only through the platform form;
- We reserve the right to decline any request for public disclosure of a report.


### DUPLICATE REPORTS POLICY
We pay a reward only for the first report received that contains all necessary data to reproduce the vulnerability.
All subsequent reports containing information about the same vulnerability are considered duplicates and are not eligible for an additional reward.
A report may be considered a duplicate of another researcher’s report or an internal security team report.
A report may also be considered a duplicate if it contains information about attack vectors that are being fixed following the processing of another report.

### CRITICALITY DETERMINATION RULES
We reserve the right to make the final decision about reported vulnerability’s severity. When we receive a report, we perform an internal investigation and determine its severity considering several factors:
- The privileges an attacker needs to exploit the issue;
- How difficult it is to discover and exploit the vulnerability;
- Whether user interaction is required;
- Impact on integrity, availability, and confidentiality of affected data;
- Data integrity, availability, and confidentiality requirements for the affected data;
- Impact on business and reputational risk;
- How many users would be affected by the vulnerability.
One of the tools we use for analysis is the CVSS v3.1 scoring calculator.

### REWARD
Rewards are paid to participants only for previously unknown security issues that meet all conditions specified in the program.

The table below shows the maximum amount of remuneration for each severity level.

Severity level — Maximum reward amount (RUB)
Critical: 150,000 – 400,000 ₽
High: 35,000 – 150,000 ₽
Medium: 7,500 – 35,000 ₽
Low: 1,000 – 7,500 ₽

For mobile applications, three severity levels are used: High, Medium, Low.

The amount of the reward is determined by YooMoney on a case-by-case basis, with the criteria outlined in this program taken into consideration and within the specified ranges.

YooMoney

YooMoney is an electronic payment service that helps individuals send money, pay for goods and services, and allows businesses to accept payments in a variety of ways: from e-wallets, via online banking, in cash, via QR, and more.

ЮMoney — российская финтех-компания. Мы сделали для пользователей электронный кошелёк ЮMoney, а для бизнеса — сервис по приёму платежей ЮKassa.

Programs