Wealthsimple looks forward to working with the security community to find security vulnerabilities in order to keep our businesses and customers safe.

SLA

Wealthsimple will make a best effort to meet the following SLAs for hackers participating in our program:

• Time to first response (from report submit) - 5 business days

• Time to triage (from report submit) - 10 business days

• Time to bounty (from triage) - 15 business days

We’ll try to keep you informed about our progress throughout the process as soon as we have updates to share, there is no need to ping us for updates.

Wealthsimple team may change the defined SLAs over time as needs and requirements change.

Disclosure Policy

Do not discuss or publicly share information related to vulnerabilities identified in Wealthsimple's Bug Bounty program, no matter what status they are in without consent from Wealthsimple.

Program Rules

• Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.

• Please use a custom HTTP header in your requests, the Header should look like the following:

X-BUG-BOUNTY:HackerOne

• Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.

• When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).

• Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.

• Please refrain from making volumetric requests that could lead system performance instability.

• If you suspect a rate limit bypass is possible on an endpoint (e.g. login or two-step verification endpoint), open a report in HackerOne with your hypothesis and we will investigate. Avoid sending many requests to prove your report.

• Social engineering (e.g. phishing, vishing, smishing) is prohibited.

• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

• Do not test or abuse any feature that interacts with CRA or Revenu Québec services, this includes NETFILE and auto-fill. (this is specific to the simpletax domain).

Test Accounts

1. You may test only with Wealthsimple account(s) for which you are the account owner.

2. You must create an account with your HackerOne email alias (e.g. hackerman @ wearehackerone.com) to be eligible for bounty.

If you’d like to create additional test accounts, add a plus (“+”) sign and any combination of words or numbers after your username. For example: username+wealthsimple@wearehackerone.com. This enables you to test different attack vectors / account levels without targeting other users or creating multiple HackerOne profiles.

Out of scope vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

• All vulnerabilities that are not direct application dependencies, do not have a direct Wealthsimple user impact and are the result of a third party will be considered informative

• Clickjacking on pages with no sensitive actions.

• Unauthenticated/logout/login CSRF.

• Attacks requiring MITM or physical access to a user's device.

• Previously known vulnerable libraries without a working Proof of Concept.

• Comma Separated Values (CSV) injection without demonstrating a vulnerability.

• Any activity that could lead to the disruption of our service (DoS). If you suspect a DoS issue exists, send us a POC and we will evaluate whether this is a concern for us.

• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS

Wealthsimple Acquisitions

Recent acquisitions by Wealthsimple not explicitly defined in the HackerOne scope are out of the program's scope for a minimum period of 3 months after the acquisition is announced. If you have a security vulnerability in a product recently acquired by Wealthsimple, please send your report to the Wealthsimple Security Team at security@wealthsimple.com.

Bounty Table

| Severity | Bounty |

|----------|--------|

| Critical | 20,000 |

| High | 5,000 |

| Medium | 1,000 |

| Low | 500 |

Proxy Configuration

You may use our pre-generated Burpsuite configuration file, which will configure your Burp proxy with our in-scope domains, found here: {F1347430}

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep Wealthsimple and our users safe!