API FONDYVersion 1.0

Vulnerability disclosure and reward program

Fondy IT security department thoroughly investigates every report related to security issues and vulnerability disclosure. If you think you have found a bug in Fondy security, contact us at security@fondy.eu and attach a detailed report on the problem found. We will respond as quickly as possible to your message. We ask you not to disclose the problem until it is fixed by Fondy specialists.

We understand and appreciate the hard work that is associated with the security research process. To show appreciation for this work, Fondy rewards the confidential disclosure of any infrastructure problem and software implementation of its services and products that could compromise the confidentiality or integrity of our users’ data (for example, bypassing the authorization process in Merchant Portal, implementing code in a session of another user or prompting to act on behalf of another user, gaining access to confidential information about orders of other users of the Fondy payment gateway).

We assess the criticality of security issues with Common Vulnerability Scoring System v3 (https://www.first.org/cvss/calculator/3.1):
None 0.0
Low 0.1 – 3.9
Medium 4.0 – 6.9
High 7.0 – 8.9
Critical 9.0 – 10.0

The approximate amount of reward for each of the levels of criticality is calculated as follows:
Low: $ 50 – $ 200
Medium: $ 200 – $ 500
High: $ 500 – $ 1500
Critical: $ 1500 – individual
Fondy reserves the right to revise the amount of reward depending on the particular case or the circumstances.

As usual practice for rewards programs, we ask you to use common sense when looking for security bugs. Expect us to eliminate the vulnerability within a reasonable time. Avoid compromising data of other users and accounts, try to use only your personal or dummy data to search for vulnerabilities.

We do not reward vulnerabilities related to:
– denial of service (DDOS)
– spam or social engineering
– vulnerabilities in third-party applications and services used in Fondy
– software version disclosure
– self-xss
– missing security flags on non-sensitive cookies
– caused a change or damage to the data of real Fondy users

The list of domains that are participating in the reward program:
* .fondy.eu
* .fondy.ua
* .fondy.ru
* .cloudipsp.com
* .cipsp.net

Out of the reward program scope:

– clickjacking and X-Frame-Options header on domains:

As with most security reward programs, there are some limitations:
– we reward only the first person who informed us about the problem
– publicly disclosed problems for which sufficient time has not waited for elimination are not rewarded
– your safety research must not violate the law

Connect to FONDY and learn more!