Ampol

Ampol is looking to the bug hunting community to help identify issues with the Ampol Australia Apps and the API services that power them so that we do not compromise personal information or expose customers to fraud.

Please use your <username>@bugcrowdninja.com email address to create your testing account(s). We reserve the right to delete and block test accounts that are found to be abusing our testing guidelines.

You must not under any circumstances attempt to attack, access or otherwise interfere with any real customer accounts

---

Targeted Rewards

These rewards will be paid to the first researcher who can successfully demonstrate each targeted attack.

Alter the Amount You Pay for Fuel

• If you can demonstrate an attack that allows you to alter the amount you pay for fuel Ampol will pay a bounty of $2500
• Acceptable proof will be a reproducible process for demonstrating the attack that demonstrates a discrepancy between the pump amount (less any legitimate discounts) and the amount processed by our payment gateway

Default Ratings & Rewards

This program will use the Bugcrowd Vulnerability Rating Taxonomy for the prioritization/rating of findings. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.