Welcome to Tapplock’s Bug Bounty Program. Tapplock considers our users privacy and security to be core principles of our platform. We believe that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you believe you’ve found a security issue in any of our products or services, we encourage you to notify us. We welcome working with you to resolve any issues inside the scope of our program as quickly as possible.
- Tapplock Android and iPhone App
- Tapplock Enterprise Android App
- Tapplock Enterprise User Android App
- Tapplock one+
- Tapplock lite
- Any software / firmware design or implementation issue that substantially affects the confidentiality or integrity of user data is likely to be in scope for the program. Common examples include:
- Broken Authentication
- Authentication and Authorization Flaws
- Remote Code Execution
- Injection attacks
- Sensitive Information leaks or disclosure
- Hardware related issues
- Known vulnerabilities
- Bugs that require exceedingly UNLIKELY user interactions
- Out of date systems (mobile systems/older app)
- Disclosure of public information and information that does not present significant risk.
- Bugs that have already been submitted by another user, that we are already aware of, or that are classified as ineligible by Tapplock.
- Bugs that are in content/services not owned by Tapplock.
- Brute forcing of intended functionality.
- Reports recommending best practices without demonstrable proof of an actual issue.
- Speculative reports or reports without enough information to confirm an issue.
- Only one bounty will be awarded per vulnerability
- If we receive multiple reports for the same vulnerability, only the first person offering the first clear report will receive a reward
- Tapplock will award a bounty depending on the likelihood and impact of the vulnerability
Low – $100-$300 USD
Medium – $300-$500 USD
High – $500-$1000 USD
Critical – $1000-$3000 USD
Our Engineers will review the submission and verify its eligibility. The review time will vary depending on the complexity and completeness of your submission, as well as on the number of submissions we receive.
Once your submission has been reviewed and the Bug has been reproduced and fixed we will then consider whether your submission is eligible for a reward. If your submission is eligible for a reward we will then contact you to arrange payment. We will recognize all individuals who have been awarded through our Online Security Services Security Acknowledgments.
Please ensure the file you submit is encrypted with our GPG Key and that the subject line of your email is a brief description of the Bug. All submissions can be sent to firstname.lastname@example.org
If you file a report and publish the information publicly before we can fix it you will not receive any reward for the work you have done to locate the Bug. In the interest of protecting our users, we would appreciate a reasonable amount of time to address and issues that are reported to us.
Why don’t you provide a reward for denial-of-service bugs?
Denial-of-services bugs are generally less serious than other web application security bugs and in many cases don’t require a technical vulnerability within the web application.
How long does it take to get the results of the review process after submitting a vulnerability report?
We try to start the review process as soon as the vulnerability is submitted, but please note that there is no set time frame for announcing results of the review process.
What do you mean by “duplicate’ submission and why was I not informed when I first submitted the report?
We consider any submission reporting a security vulnerability that was already know to us, either because of a previous bug bounty report or because we had already detected it ourselves, as a duplicate submission.
In order to best protect our customers, Tapplocks policy is to hold back on making any notifications on duplicate report conditions until we have remediated the potential exposure.
You fixed my bug, why have I not been paid?
We do not pay bounties on an individual basis at this time. All payments will be made on a quarterly basis.
Q1: January – March: Early May
Q2: April – June: Early August
Q3: July – September: Early November
Q4: October – December: Early February
- We are unable to issue rewards to individuals who are on sanctions lists, or who are in countries on sanctions lists.
- You are responsible for any tax implications depending on your country of residency and citizenship.
- There may be additional restrictions on your ability to enter depending upon your local law.
- This is an experimental and discretionary rewards program. You should understand that we can cancel the program at any time and the decision as to whether or not to pay a reward has to be entirely at our discretion.
- Testing must not violate any law, or disrupt or compromise any data that is not your own.