Program stats

16 vulnerabilities rewarded

Validation within about 1 month
75% of submissions are accepted or rejected within about 1 month

$2,566.66 average payout (last 3 months)

Latest hall of famers

Recently joined this program

Disclosure

Please note: This program does not allow disclosure. You may not release information about vulnerabilities found in this program to the public.

Serious about security

Our approach to security is designed to protect buyers and sellers. We monitor every transaction, continuously innovate in fraud prevention, and we protect businesses’ data like our business depends on it—because it does. We adhere to industry-leading standards to manage our network, secure our web and client applications, and set policies across our organization.


This program adheres to the Bugcrowd Vulnerability Rating Taxonomy for the prioritization/rating of findings.

Rewards:

Priority           Reward
P1 $5,000
P2 $2,500
P3 $500
P4 $300

We are particularly interested in problems with Square’s payment flows. Confirmed vulnerabilities that directly affect our payments flows will receive a $500 minimum reward.

Targets

Any domain/property of Square not listed in the targets section is out of scope. This includes any/all subdomains not listed above.

Target Information

Squareup.com - Landing page for documentation/resources: https://squareup.com/developers
Cash App for iOS: Here
Cash App for Android: Here
Square Point of Sale for iOS: Here
Square Point of Sale for Android: Here

Access

Please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here.

Special CTF-style Flags!

Find the Account

We've created an account with an email address as ftwr+[32 character flag]@squareup.com. Tell us how you found it, and you'll get a $1000 bounty.

The SHA1 digest of the flag is: b9559723b3fd537e368fdc5c221eef72dc2e8adc.

Find the File

Find a file called BUGCROWD-flag.txt with the contents containing ftwr+[32 character flag]. Tell us how you found it, and you'll get a $1000 bounty.

The SHA1 digest of the flag is: 1fb27653e08cef9c6acdd520f2e9398ad3576549.

Computing the sha1

To make sure you know that you have found the right flag, we are publishing the digests of the flags by running echo [32 characters] | sha1sum. You can do the same on your terminal (you might need to install sha1sum or use an alternate method).
For example, if the value of the token were fb3f8fe63cc107c1977855c95633fb13 (it's not), then you would get:

~ echo -n fb3f8fe63cc107c1977855c95633fb13 | sha1sum
53aa4d47f93b76214834193baefb9c6e7d042c11 -

Rules

Some things to keep in mind when hunting for flags:

  • Only flags created by Square are eligible for the reward. There will be at most one reward per flag.
  • Only the first person to report a flag and methodology for discovery will be rewarded.
  • The flags are long enough that brute force won't work. You'll have to be more creative!

Program Exclusions

  • Any physical attempts against Square property or data centers
  • Self-XSS
  • Logout CSRF
  • Presence of autocomplete attribute on web forms
  • Missing cookie flags on non-sensitive cookies
  • No maximum password length
  • An oracle that discloses whether a given username, email address, or phone number is associated with an actual account. (However, please do submit anything that allows you to recover usernames en masse.)
  • Using spoofed emails for phishing
  • Reports of the 2-factor token not expiring. We use TOTP codes for two factor.

Disclosure procedures

Square recognizes the important contributions the security research community can make. We encourage coordinated reporting of security issues with our services. We take the security of our services very seriously and monitor their use for indications of a malicious attack. In order to allow us to identify legitimate security research as opposed to malicious attacks against our services, we promise not to bring legal action against researchers who:

  • Share with us the full details of any problem found.
  • Do not disclose the issue to others until we’ve had a reasonable time to address it.
  • Do not intentionally harm the experience or usefulness of the service to others.
  • Never attempt to view, modify, or damage data belonging to others.
  • Do not attempt a denial-of-service attack.
  • Do not perform any research or testing in violation of the law.

Attributes of a good report

  • Detailed steps for reproducing the bug. If valuable, please include any screenshots, links you clicked on, pages visited, etc. We prefer detailed repro steps over video demos.
  • Describe the versions of all relevant components of the attack (eg browser, OS, mobile app version).
  • Describe a concrete attack scenario. How will the problem impact Square or Square buyers/sellers? Put the problem into context.

Regarding Cryptocurrency

Please submit any issue related to cryptocurrency to the Square program immediately. Square is eager to work with the community to make sure that every researcher finding related to cryptocurrency will be fairly rewarded given the vulnerability's impact on business and overall severity. This includes compensation that might be higher than what is advertised currently.


OpenPGP key

If you have data that you feel is particularly sensitive and would like to encrypt before sending it to our bug bounty, please use the following OpenPGP key for encryption:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2

mQENBFQKLngBCADIGP81CNlJK9AvC2aZI0fQU8Zq6i48Gj1KsV1HtSlvfTs1HDzD
VxOWSKAuof/K3fKAYzIUYis8l39gCnwIB1ozlseZz3cPkjnvlMc0wRTZ4fohyIxP
d4hs6atxAImUiQHErM1OI9UmXA1DX2lH3hz3w3wD0qBY/1c+qp/Tju0BZHLonion
C9n7AHv78Z3Fg1F/4xLAn0V7JMS7BSK0fp5s/hTHa3ZHYBsL/To7mZ9lmqx5XEiW
GXBMbqHQoBwK2ETywQMreuDIqn+HowkLJhMcW3ir+iKZfE3Z3HwP+v/RcyZvND0c
eKadqm0rd2INpH02nZeAC68Ac1o4D+GWaDoxABEBAAG0JVNxdWFyZSBJbmZvc2Vj
IDxpbmZvc2VjQHNxdWFyZXVwLmNvbT6JAT0EEwEIACcFAlQKLngCGwMFCRLMAwAF
CwkIBwMFFQoJCAsFFgMCAQACHgECF4AACgkQrhC6tawqxoqj0gf9EpM2UtkT6Vwa
/R7XzF6kn5LWKRUCY2Cqq2pKdC4aEsgE1TJfEWaz4VM2QuladYbdywRde8cauD2g
cABvebngzL70M8OeLkIRxNcmQUvuUY08dNjJcKAaAiIdVtVHat9u5fxo2vl+NbYM
09G04+8lfg8SoB+1P6Jb7Ia8OSW5o6SCtp2MJ7nXaqEOdEvXPRCHqhiifeOqq94j
pVe1DlTxHLZT+alhemB8Ax9NlyV7FU5i06890ZIaBBWUfKF5ZUAqUy9Juh/35U4a
bVqNy8jAS3OPkGEZjHcJj9dQAlgXrvxe+sqsSyUvJgByOSjV0dhHbO6Xgobc/EPB
xWKl7ECIrrkBDQRUCi54AQgAqI4ImtjxoCdM9RwCkHaoUjZPtVmVQah6/8W/DAm9
Gi3TFuQVWahq5FRMahGZ4HfhjJyY9X0STS04jRNjcRZVgD98wvoRyBfnuognRaS7
/vIwYRPwnJ5ipWkC9La0uivn+wmQYO1p3Lq5ZoH9RaxgGIpytZ7hTMK9zfXqJ899
HUXYhF7zOUdcMzHMukpybR7yiZTRpsbl8JoQtZ8aB8JQ0ML4ca0/7syqoH8F3aVV
MvYEnlGY1iy8npLzVUCDStLJxQ7290kSED8t0v0YNhOtkg7/bZEdNcB56bVJ6uTu
3j/ETuLwJN62dRInDSYfhGAewvg3QfrirGJfesYYuKBn4QARAQABiQElBBgBCAAP
BQJUCi54AhsgBQkSzAMAAAoJEK4QurWsKsaKnFUH/jMnMIEfuen/NQa3cVyburgj
Xai9KTyqjIQeXS2tnYWqNE5WfR/CSkJ4dJ6A4vsd4xacbQRw+feJkOOUUqUR6ZjM
CuUMN4k4DwAom7NKobLs+35Iam6ODgJIhQG/5zCvrtIbuKvoEVHfxY59LqIFB4tI
bclvS7mKQKkAGa7aVm6/ZqtSU5oV/ZqM2kawtE4vA3Yy0Woax9sqe9U3kD4mFUY+
f/GNmvtiUR/wddpUuTGY5gxitsYZB68zIlTd9UDmX3q2jqgF1ZdhacTKo95Aluy3
49+SyjPZcvCZyJhgiHBhWN2VbHuKDJYhmiaVN7Iyswzj6WWf/jUVrM1u0gJVY2C5
AQ0EVAoueAEIALWhKlYA3CZXnbgnI9CA2qZ5wq3wo5SeokHUpoJ1SF3wKXkhfrrK
Qg+3/CIcc6d0nVoiMEdB51XH5Ahse647bA93urz0IWMagR24JzYx7sXToBZ2jrdX
4/0Stp+GbhMRCRuK8ml2m46Vi+vhs3YkDmP+qpruyo5XLSRlTYYJKOVCqi75a84h
b9dZM7BGjPuyuuDS9wq1uq+G8mwfg5G5fIilVPxOuXJmsZqANfYZdatL4pCkudBn
EtHeJGVqcQLoeUCSyb7O5BEXvMp43P6N1Y9Q5tQlaXUwoF8R2Ni30/Rl4gzSDgzg
VB4MSZdDZLWn6ymDJOt+Mv+BVkyfa2QqGP8AEQEAAYkBJQQYAQgADwUCVAoueAIb
DAUJEswDAAAKCRCuELq1rCrGilqBCADD9T/5g3eQKSHHSbhbIjvACSqnIshc+EYS
o5U6DXEbdoqE9tad8enEJiuR2N+8X3DwvGLr+quX+tqHX7/FPnqp3kEU793uH4q6
7gdyqa4/RGMM3IjBktRrvW+UHHkXZf0VqBalsfDcC+bXxWljUzByDScOw5hsJuRM
3dRZdWHHrl2wIIAid+97Om73sLn1tm/2oq03aSbRmhRfOLjXF/QEErRipzFqI/kG
GzYX1BpwDCPDVIzjTN+eFUcsv/OwBy2EYayOzVmG/WjoO5EGt83eG+/JeLn6+GRy
6Lv8d1oHPpOq5dv9M80nhQ2s9C5o17WMcbUcZMKx95txnN/r09yb
=ptIx
-----END PGP PUBLIC KEY BLOCK-----

Rules

This program follows Bugcrowd’s standard disclosure terms.

This program does not offer financial or point-based rewards for P5 — Informational findings. Learn more about Bugcrowd’s VRT.