Empower Personal Wealth

Here at Empower, we believe in the power of technology to change the financial industry, making it more accessible, affordable, and honest. And we believe in the power of people to change the nature of investment advice, making it more transparent, objective, and personal. We are building a better money management experience for everyone with technology.

Your mission, researcher, should you choose to accept it is to help to ensure that our front end web application stack and back-end API endpoints are tough as nails. Nobody wants their favorite money management app to leak sensitive data out.

The Empower Personal Wealth web application is an HTML5 web app using single-page design and using Backbone, React and Angular for rendering web content. The application calls our backend RESTful APIs, written in Java with Spring MVC and JPA. We use RDBMS for persistent storage. You are welcome to stalk our engineering blog for further insights. While we are not providing researchers with the full list of all of our APIs, we do want to help researchers out. If you think you are onto something but just need a bit more information on a specific API, let us know!

---

Ratings/Rewards

For the initial prioritization/rating of findings, this Bug Bounty Program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher along with the opportunity to appeal and make a case for a higher priority. Please see below for deviations.