The primary objective of our Bug Bounty Program is to encourage the responsible disclosure of security vulnerabilities in our products and services. By providing incentives to security researchers, we aim to improve the overall security posture of our organization and protect our users' data.
To notify Mamo of a vulnerability, please submit your findings here: goto.mamopay.com/bug-bounty
Please note that:
Direct email outreach to the security team is not accepted. All reports must be submitted through the official submission form to ensure proper documentation and timely review.
Submissions are reviewed at Mamo’s discretion. We do not guarantee a response to every submission, and receipt of your report does not constitute confirmation that a vulnerability exists or is valid.
Eligible vulnerabilities
This program is open to anyone who discovers and responsibly reports security vulnerabilities in Mamo's products and services. It however excludes the following:
Mamoers
Employees of third-party vendors and contractors working for / with Mamo
For the vulnerability to qualify, the reporter must showcase a security exploit that is reproducible in the submission form.
Note that only domains that are currently being used to deliver Mamo’s core services qualify for this program. For sub-domains managed by other service providers, please report issues to their respective security teams.
The list of vulnerabilities covered include:
Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF)
Significant vulnerabilities in access control setup.
Server-Side Request Forgery (SSRF).
Injection flaws.
Cryptographic failures.
Significant security misconfigurations.
Significant product flaws that compromise our user’s assets.
Common vulnerability exclusion list
The following are ineligible for rewards:
Impacts requiring attacks that the reporter has already exploited themselves, leading to damage.
Impacts caused by attacks requiring access to leaked keys/credentials.
Mentions of secrets, access tokens, API keys, private keys, etc. will be considered out of scope without proof that they are in-use in production.
Self-XSS.
Login/Logout CSRF.
CSRF configuration issue without exploitable proof of concept.
Best practice recommendations
Feature requests
Absent security headers which do not directly result in a vulnerability.
Vulnerabilities in third-party components, depending on severity and exploitability.
Rate Limit on emails sent during registration, authentication, and email change confirmations.
EXIF not removed from uploads, unless discoverable outside of the workspace.
Denial of Service (DOS) and rate limiting issues.
Bugs requiring highly improbable user interaction.
Social engineering attacks.
Flaws affecting users of outdated browsers and plugins.
Enumeration or disclosure of non-sensitive information.
Enumeration of information within a single workspace context.
Lack of input validation without exploitable proof of concept.
Email bombing and flooding.
Email and domain spoofing.
Some reported issues may not qualify if they don't present a significant risk to the business.
Guidelines
Do not disclose the bug publicly before it has been resolved.
Do not attempt to access another user's account or data. Use your own test accounts for cross-account testing.
Do not conduct any attack that could compromise the reliability or integrity of our services data. DDoS or spam attacks are prohibited.
Do not exploit the vulnerability to gain unauthorized access or harm our systems or users.
Do not affect other users with your testing, including testing for vulnerabilities in accounts you don't own. We may suspend your account and block your IP address if you do so.
Do not use scanners or automated tools to find vulnerabilities. They're disruptive and we may suspend your account and block your IP address.
Provide all necessary details for us to reproduce and validate the vulnerability.
Reporting process
Review the Bug Bounty Program guidelines above before submitting your report. This guide provides detailed instructions on the types of vulnerabilities that can be reported and the criteria for submission.
Security researchers who identify a potential vulnerability should report it to Mamo by submitting the form.
Our security team will review the submission.
If the vulnerability is accepted, the reporter will receive a reward based on the severity and impact of the issue.
How we deal with submissions
Submissions go through a form-based review. Where we are able to follow up, we aim to acknowledge within 48 hours. However, not all submissions will receive individual responses, and we are unable to confirm the validity of every reported vulnerability.
Should your report be valid and accepted, we will keep you informed as we work to resolve the bug you submitted.
We will not take legal action against you if you adhere to the guidelines and act in good faith.