PhonePe’s responsible disclosure policy

Be the first person to responsibly disclose the bug.

Report a bug that could compromise our users’ private data, circumvent the system’s protections, or enable access to a system within our infrastructure.

• Hall of Fame

You give us reasonable time to investigate and mitigate an vulnerability that you report.

Please refrain from accessing sensitive information (by using a test account and/or system), performing actions that may negatively affect other PhonePe users (denial of service), or sending reports from automated tools.

You do not exploit a security vulnerability that you discover for any reason. (This includes demonstrating additional risk, such as attempted compromise of sensitive company data or probing for additional issues.)

Violating any laws or breaching any agreements in order to discover vulnerabilities.

You do not publicly disclose details of a security vulnerability that you’ve reported without PhonePe’s permission.

We recognise security researchers who help us to keep users safe by reporting vulnerabilities in our services. Recognition for such reports are entirely at PhonePe’s discretion, based on risk, impact and other factors. For recognition in PhonePe’s Hall of Fame, you first need to meet the following requirements:

• Adhere to our Responsible Disclosure Policy
• Report a security bug: identify a vulnerability in our services or infrastructure which creates a security or privacy risk. (Note that PhonePe ultimately determines the risk of an vulnerability, and that many software bugs are not security vulnerabilities.)
• Your report must describe a problem involving one of the products or services listed under “Scope”.
• We specifically exclude certain types of potential security vulnerabilities; these are listed under “Exclusions”.
• If you inadvertently cause a privacy violation or disruption (such as accessing account data, service configurations or other confidential information) while investigating an vulnerability, make sure that you disclose this in your report.

In turn, we will follow these guidelines when evaluating reports under our responsible disclosure programme:

• We investigate and respond to all valid reports. Due to the volume of reports that we receive, however, we prioritise evaluations based on risk and other factors, and it may take some time before you receive a reply.
• We determine recognition in hall of fame based on a variety of factors, including (but not limited to) impact, ease of exploitation and quality of the report. Note that extremely low-risk vulnerabilities may not qualify for hall of frame at all.
• In the event of duplicate reports, we give recognition to the first person to submit a vulnerability. (PhonePe determines duplicates and may not share details on the other reports.)

Note that your use of PhonePe services including for the purposes of this programme, is subject to PhonePe’s Terms and Policies. We may retain any communications about security vulnerabilities that you report for as long as we deem necessary for programme purposes, and we may cancel or modify this programme at any time.

Android PhonePe

iOS PhonePe

Android Business PhonePe

iOS Business PhonePe

https://phonepe.com

https://mercury.phonepe.com

https://insights.phonepe.com

If you happen to have identified a vulnerability on any of our web or mobile app properties, we request you to follow the steps outlined below:

• Please submit the vulnerability report form with the necessary details to recreate the vulnerability scenario. This may include screenshots, videos or simple text instructions.
• If possible, share with us your contact details (phone number), so that our security team can reach out to you if further inputs are needed to identify or close the problem.
• If the identified vulnerability can be used to potentially extract information of our customers or systems, or impair our system’s ability to function normally, then please refrain from actually exploiting such a vulnerability. This is absolutely necessary for us to consider your disclosure a responsible one.
• While we appreciate the inputs of Whitehat hackers, we may take legal recourse if the identified vulnerabilities are exploited for unlawful gains or getting access to restricted customer or system information or impairing our systems.

Report a Vulnerability

Any design or implementation issue that is reproducible and substantially affects the security of PhonePe users is likely to be in scope for the program. Common examples include:

• Injections
• Cross Site Scripting (XSS)
• Cross Site Request Forgery (CSRF)
• Remote Code Execution (RCE)
• Authentication/Authorisation flaws
• Domain take-over vulnerabilities
• Able to take-over other PhonePe user accounts (while testing, use your own another test account to validate)
• Any vulnerability that can affect the PhonePe Brand, user data and financial transactions

The following bugs are unlikely to be eligible:

• Vulnerabilities found through automated testing
• “Scanner output” or scanner-generated reports
• Publicly released CVE’s or 0-days in internet software within 90 days of their disclosure
• “Advisory” or “Informational” reports that do not include any PhonePe testing or context
• Vulnerabilities requiring MITM or physical access to the victim’s unlocked device.
• Denial of Service attacks
  • – SPF and DKIM issues
  • – Content injection
  • – Hyperlink injection in emails
  • – IDN homograph attacks
  • – RTL Ambiguity
• Content Spoofing
• Vulnerabilities relating to Password Policy
• Full-Path Disclosure on any property
• Version number information disclosure
• Third-party applications on the PhonePe Application directory (identified by the existence of a “Report this app” link on the app’s page). Please report vulnerabilities with these services to the creator of that specific application.
• Clickjacking on pre-authenticated pages, or the non-existence of X-Frame-Options, or other non-exploitable clickjacking vulnerabilities
• CSRF-able actions that do not require authentication (or a session) to exploit
• Reports related to the following security-related headers
  • Strict Transport Security (HSTS)
  • XSS mitigation headers (X-Content-Type and X-XSS-Protection)
  • X-Content-Type-Options
  • Content Security Policy (CSP) settings (excluding nosniff in an exploitable scenario)
• Bugs that do not represent any security risk
• Security bugs in third-party applications or services built on the PhonePe API – please report them to the third party that built the application or service
• Security bugs in software related to an acquisition for a period of 90 days following any public announcement
• HTTP TRACE or OPTIONS methods enabled
• Non-sensitive (i.e., non-session) cookies missing the Secure or HttpOnly flags
• Tap jacking
• Mobile client issues require a rooted device and/or outdated OS version or SSL pinning issues.
• Subdomain takeovers without supporting evidence
• Missing best practices in SSL/TLS configuration.
• The Vulnerabilities that cannot be used to exploit other users or PhonePe — e.g., self-XSS or having a user paste JavaScript into the browser console
• Open ports without an accompanying proof-of-concept demonstrating vulnerability
• Vulnerabilities in the whitehat report form

We do not have a bounty/cash reward program for such disclosures, but we express our gratitude for your contribution in different ways. For genuine ethical disclosures, we would be glad to publicly acknowledge your contribution in this section on our website. Of course, this will be done if you want a public acknowledgement.

Phonepe thanks the following People for finding & responsibly disclosing security vulnerabilities in phonepe owned Apps, products or services. We are grateful for their contribution & efforts towards the security of PhonePe.

• Dhruv Shekhawat
• Saeel N Relekar
• Rahul Kumar Sah (CyberBeast)
• Lohith Gowda M
• Chaitanya Surabhi
• Srikanth Bairi
• Sivadanam Yaswanth Lingam
• Akash Kumar
• Ahmed Ramzy Ibrahim
• Mayank Kumar
• SaiKumar Reddy Duganapalli