Bug Bounty Program

The following outlines the scope, participation policy, reporting procedures, and reward standards for the MAX “Bug Bounty Program.”

Scope

This program covers the following websites, APIs, and apps:

• www.maicoin.com (https://www.maicoin.com/)
• max.maicoin.com (https://max.maicoin.com/)
• api.maicoin.com (https://api.maicoin.com/)
• max-api.maicoin.com (https://max-api.maicoin.com/)
• Android: com.maicoin.maicoin (https://play.google.com/store/apps/details?id=com.maicoin.maicoin)
• Android: com.maicoin.max (https://play.google.com/store/apps/details?id=com.maicoin.max)
• iOS: MaiCoin https://itunes.apple.com/tw/app/id1439583926
• iOS: Max https://itunes.apple.com/tw/app/id1370837255

Participation Policy

• Please provide MAX detailed reports with reproducible steps.
• Provide MAX a reasonable amount of time to resolve the issue.
• Please do not disclose any vulnerabilities, any information you reported to MAX, and any feedback from MAX regarding the vulnerabilities to any third party without the prior written consent of MAX even if the vulnerabilities have been resolved. 
• Do not attempt to view, modify, or damage data belonging to others.
• Do not submit vulnerability reports automatically generated by generative AI (e.g., ChatGPT).
• MAX is entitled to terminate the program or revise the clauses of this program unilaterally in any time.

Eligibility for Rewards

You must meet all of the following conditions simultaneously to be eligible for a reward:

• The reporter must be the first person to report the issue to us. We will review the duplicate bugs to see if they provide additional information, but otherwise only reward the first reporter.
• The vulnerability you reported is confirmed to be verifiable, reproducible, exploitable, and included in the scope.
• The reporter have complied with the program terms and regulations.
• The reporter have to report the issue before the program is terminated.

Out of Scope

The following issues and related activities are not within the scope of this program:

• Social engineering(e.g. phishing).
• Physical security.
• Non-security-impacting UX issues.
• Deprecated Open Source libraries are not in scope. If you would like to report a vulnerability for one of these libraries, please submit it on GitHub via an issue or PR. 
• Missing best practices in SSL/TLS configuration.
• Self-XSS and issues exploitable only through Self-XSS.
• Clickjacking on pages with no sensitive actions.
• Related to tab-jacking, tab-nabbing, and text injection.
• Related to DNS over HTTPS, DNSSEC, and DNS CAA record.
• Attacks requiring MITM, physical access or privileged access(e.g. root a phone) to a user's device.
• Any activity that could lead to the denial/degradation of service (DoS).
• Enforcement policies for brute force or account lockout.
• Missing security headers.
• Unauthenticated/logout/login CSRF.
• Comma Separated Values (CSV) injection without demonstrating a vulnerability.
• Unconfirmed reports from automated vulnerability scanners or AI-generated analysis tools.
• Theoretical vulnerabilities without concrete exploitation or realistic impact demonstration.
• Missing security best practices or headers without a working Proof of Concept.
• Disclosure of server or software version numbers.
• Disclosure of known public files and other information disclosures that are not a risk (e.g. robots.txt).
• Disclosure of information with minimal security impact (e.g. stack traces, path or directory listing, logs).
• Theoretical sub-domain takeovers with no supporting evidence.
• Vulnerabilities or weaknesses in third party applications that integrate with MAX.
• Issues only present in end-of-life software.
• Ability to abuse existing banking functionality.
• Exposure of the IP address or domains.
• Spamming or Un-limiting Email rate.
• Known vulnerabilities in third-party software (e.g., WordPress core/plugins) without a working PoC.
• Informational WordPress issues identified by automated scanners (e.g., version disclosure, user enumeration, xmlrpc.php).

Rules of Engagement

When participating in this program, you must not engage in the following activities:

• Any act that violates the rights of others or the law.
• Spamming MAX users arbitrarily with spam messages.
• Submitting a large volume of low-quality, unverified, AI-generated, or theoretical vulnerability reports.
• Viewing, deletion, modification or disclosure of other users’ data using the discovered vulnerability.
• Viewing, deletion, modification or disclosure of source code using the discovered vulnerability.
• Any act other than those listed above that is contrary to the spirit and purpose of the program.

Response Targets

MAX will make reasonable efforts to adhere to the following response targets:

Program Inquiries

All inquiries regarding the program are to be submitted to the [email protected]. Inquiries sent by any other method will not receive a response.

Vulnerability Investigation and Reporting

Please contact us at [email protected] if you have found a vulnerability, and use PGP encryption offered by MaiCoin when sending bug reports to us. MaiCoin Security Team will respond to your report within three work days, and will soon release the vulnerability fix according to its severity.

PGP Public Key

Bounty Standards

Reward will paid out in USDT or in the equivalent amount of TWD. Once your submission is accepted, please provide either of the following to receive your reward.

• Your USDT wallet address.
• Your NTD bank account.

Vulnerability Severity Guidelines

MAX classifies the following issues as “Critical” risk:

• Read /write sensitive data in a system.
• SQL injection
• Remote arbitrary code execution
• Vertical authentication/authorization bypass
• Exfiltrate digital or fiat currency
• And other critical-severity issues

MAX classifies the following issues as “High” risk:

• Server-side request forgery to an internal service
• Stored/Reflected XSS in the core service
• Lateral authentication/authorization bypass
• And other high-severity issues

MAX classifies the following issues as “Medium” risk:

• Cross-site request forgery
• Server-side request forgery
• Sensitive information/data disclosure
• Server misconfiguration or provisioning errors with the immediate risks
• Arbitrary file upload with the immediate risks
• And other medium-severity issues

MAX classifies the following issues as “Low” risk:

• Server misconfiguration or provisioning errors
• Found demo/example configuration
• General information disclosure
• And other low-severity issues