Our approach to security is designed to protect the CashApp ecosystem. We monitor every transaction, continuously innovate in fraud prevention, and we protect our customers’ data like our business depends on it --- because it does. We adhere to industry-leading standards to manage our network, secure our web and client applications, and set policies across our organization.
This program adheres to the Bugcrowd Vulnerability Rating Taxonomy for the prioritization/rating of findings.
We are particularly interested in problems with CashApp’s payment flows. Confirmed vulnerabilities that directly affect our payments flows will receive a $400 minimum reward.
A Note on Similar Submissions:
We ask that researchers who are able to identify the same or similar types of issues in multiple locations across one of our applications combine those findings into a single submission that includes a description as well as the various locations where vulnerabilities have been identified. This greatly assists us in our triage process and allows us to process your submissions faster. The combined submissions will be evaluated holistically and will receive rewards corresponding to the collective findings. For example, if an application is discovered to have broken access control on a number of API endpoints, please submit a single submission that includes a list of those API endpoints. If separate submissions are made, they may be inadvertently closed as duplicates.
Any domain/property of Square not listed in the targets section is out of scope. This includes any/all subdomains not listed above.
This program follows Bugcrowd’s standard disclosure terms.
This program does not offer financial or point-based rewards for P5 — Informational findings. Learn more about Bugcrowd’s VRT.
|Scope Type||Scope Name|
Cash App Mobile Application for Android
Cash App Mobile Application for iOS
This program crawled on the 2021-04-07 is sorted as bounty.