Changes to Program Terms

The Bug Bounty Program, including its policies, are subject to change or cancellation by MMT at any time, without notice. As such, we may amend these Program Terms and/or its policies at any time by posting a revised version here.

Ineligible Reports and False Positives

Some submission types are excluded because they are dangerous to assess, and/or because they have low impact to us. This section contains issues that are not accepted under this program, will be immediately marked as invalid, and are not rewardable.

• Security issues in third-party services that integrate with MMT. These are not managed by MMT and do not qualify under our guidelines for security testing.
• Findings from physical testing such as office access (e.g. open doors, tailgating).
• Findings derived primarily from social engineering (e.g. phishing, vishing).
• send any updates or changes to your booking(s);
• Functional, UI and UX bugs and spelling mistakes.
• Refrain from running automated tools.
• Vulnerabilities as reported by automated tools without additional analysis as to how they're an issue.
• Issues that require physical access to a victim's computer.
• Network or application level Denial of Service (DoS/DDoS) vulnerabilities.
• Website scraping.
• Bugs requiring exceedingly unlikely user interaction.
• Flaws affecting the users of out-of-date browsers and plugins.

The following finding types are specifically excluded from the bounty:

• Descriptive error messages (e.g. Stack Traces, application or server errors).
• HTTP codes/pages or other HTTP non-codes/pages.
• Disclosure of known public files or directories, (e.g. robots.txt).
• Clickjacking and issues only exploitable through clickjacking.
• CSRF in forms that are available to anonymous users.
• CSRF with minimal security implications (Logout CSRF, etc.).
• Presence of application or web browser 'autocomplete' or 'save password' functionality.
• Lack of Secure/HTTPOnly flags on non-sensitive Cookies.
• Lack of Security Speed Bump when leaving the site.
• Weak Captcha / Captcha Bypass.
• Most brute-force issues or issues that can be exploited using brute-force.
• Open re-directs.
• HTTPS Mixed Content Scripts.
• Self-XSS.
• Username / email enumeration.
• Publicly accessible login panels.
• Reports that state that software is out of date/vulnerable without a proof of concept.
• Host header issues without an accompanying proof-of-concept demonstrating vulnerability.
• Stack traces that disclose information.
• Best practices concerns.
• Internal IP disclosure.
• Lack of enforcement of HTTPS via redirection.
• Fingerprinting issues (e.g. open ports without an accompanying proof-of-concept demonstrating vulnerability, banner grabbing).
• Sensitive data in URLs/request bodies when protected by SSL/TLS.
• Issues reported in microsites with minimal or no user data.
• Issues that affect singular users and require interaction or significant prerequisites (MitM) to trigger.
• Missing security headers that do not present an immediate security vulnerability.
• SSL Issues, e.g.:
• SSL/TLS scan reports (output from sites such as SSL Labs).
• SSL Attacks such as BEAST, BREACH, Renegotiation attack.
• SSL Forward secrecy not enabled.
• SSL weak / insecure cipher suites.

Out of Scope bugs for Android apps

• Absence of certificate pinning.
• Sensitive data stored in app private directory.
• User data stored unencrypted on external storage.
• Lack of binary protection control in Android app.
• Shared links leaked through the system clipboard.
• Any URIs leaked because a malicious app has permission to view URIs opened.
• Sensitive data in URLs/request bodies when protected by TLS.
• Lack of obfuscation.
• OAuth "app secret" hard-coded/recoverable in APK.
• Crashes due to malformed Intents sent to exported Activity/Service/BroadcastReceiver (exploiting these for sensitive data leakage is commonly in scope).

Out of Scope bugs for iOS apps

• Absence of certificate pinning.
• Lack of exploit mitigations i.e., PIE, ARC, or Stack Canaries.
• Path disclosure in the binary.
• User data stored unencrypted on the file system.
• Lack of binary protection (anti-debugging) controls.
• Lack of obfuscation.
• Lack of jailbreak detection.
• Runtime hacking exploits (exploits only possible in a jailbroken environment).
• OAuth "app secret" hard-coded/recoverable in APK.
• Snapshot/Pasteboard leakage.
• Crashes due to malformed URL Schemes.