Responsible disclosure
Found a flaw? Tell us.
The Mercado Facinho bug bounty program rewards people who find a vulnerability in our systems and report it responsibly, before any public disclosure.
- Safe harbor for those who follow the rules
- Cash reward, based on impact
Scope
What you may and may not test.
In scope
- Mercado Facinho (facinhosmurfs.com.br/mercado) and the user dashboard
- The store (facinhosmurfs.com.br)
- The API (api.facinhosmurfs.com.br)
- The admin and client dashboards
Out of scope
- Denial-of-service attacks and load testing
- Social engineering, phishing and contacting our staff or customers
- Third-party services, such as payment providers and the games
- Spam and mass automated scanning
Rules
Follow these rules to be covered by safe harbor.
- Use only your own accounts and data to test.
- Stop as soon as you prove the flaw exists, without digging deeper.
- Touch other people’s data only as little as needed to prove the flaw.
- Send the report with steps, impact and proof.
- Agree with us before disclosing any detail.
Reward
The reward is paid in cash, based on the impact of the flaw and the quality of the report. For duplicates, the first valid report counts. Lower-impact flaws go to the hall of fame.
What interests us
- Remote code execution and mass access to customer data.
- Payment or balance fraud.
- Access to another user’s data, account takeover and injection with real impact.
- Stored XSS, authorization flaws and information leaks.
Safe harbor
If you act in good faith and follow the rules on this page, we will not sue you or involve the authorities because of your research, and we will work with you to understand and fix the problem. This applies to the scope above.
How to report
Security reports go by e-mail, on a channel separate from regular support.
The button opens an e-mail with a report template. We also accept reports in Portuguese.
Machine-readable contact: security.txt
What to include in the report
- Summary: the flaw in one sentence and where it is (URL, endpoint or dashboard).
- Steps: to reproduce, in order.
- Impact: what an attacker could do.
- Proof: screenshot, video or request, without other people’s data.
- Name or handle: if you want to appear in the hall of fame.
After the report
- Report
You send us the report by e-mail, with steps, impact and proof.
- Triage
We assess the impact, keep you informed and agree on the reward.
- Hall of fame
With your consent, we give public credit to those who helped.
Frequently asked questions
Do I need to be a customer to take part?
No. Any researcher can take part, as long as they follow the rules.
Can I test with my own account?
Yes, and it is the recommended way. Use only your own accounts and data. To prove a flaw that reaches other people’s data, stop at the minimum needed and tell us.
How will I know whether the report was accepted?
We reply by e-mail. After triage we share the assessed impact and the reward.
Is the reward paid in cash?
Yes. The amount depends on the impact of the flaw and the quality of the report.
Can I publish what I found?
Agree with us first. We disclose together, by mutual agreement.
Hall of fame
Nobody here yet. The first valid report opens the list, with the name or handle you choose.