Vulnerability Disclosure Program
We welcome reports from security researchers and the community. If you have discovered a security issue, please contact us.
To participate and receive a reward, the following rules must be followed:
- You acknowledge that any information obtained in the course of participation is confidential and must not be disclosed without written consent from the ABCP Platform team.
- Reports on discovered vulnerabilities must follow reporting guidelines.
- Attacks that harm the availability or integrity of services (e.g., DoS, brute-force), or automated vulnerability scans generating significant traffic are prohibited.
- Social engineering against ABCP Platform staff or clients, phishing, or any impact on physical objects (offices, datacenters) is not allowed.
In Scope
- Online shop on ABCP Platform *
- A control panel of shops on ABCP Platform *
- Shops APIs (public-facing) *
* Note on .ru-Segment Resources:
Please note that reports related to resources in the .ru and .by segments of the platform are handled by a separate partner organization. As such, processing times and procedures may differ due to varying operational and regulatory
requirements.
Out of Scope
- Third-party services not managed by us
- Denial-of-Service (DoS) attacks
Accepted Vulnerabilities
Critical backend vulnerabilities are of highest interest, such as:
- Unsafe authentication/authorization, session mismanagement
- Account takeovers
- Injections (SQL, XML, etc.)
- XSS, CSRF affecting sensitive data (PoC required)
- Privilege escalation
- Arbitrary code execution
- Sensitive data exposure or leaks
- Open redirections (if security impact is demonstrated, e.g., token theft)
Out-of-Scope Vulnerabilities
The following are not accepted:
- Vulnerabilities in resources outside of the scope
- Information leaks about usernames, emails, phone numbers, public info (e.g., usernames)
- Low-impact XSS/CSRF, including self-XSS, outdated browsers
- Issues without clear security impact (e.g., logout CSRF, CSP headers)
- Use of leaked credentials (unless PoC shows real risk)
- Misconfigurations, theoretical issues without exploitability
- Denial of Service via traffic floods or brute-force
- Issues requiring malware, root access, MITM, or physical proximity
- Reverse engineering or lack of obfuscation alone
- Spam/malware uploads, weak CAPTCHA reports
- Social engineering-based vulnerabilities
- Vulnerabilities in third-party tools unless ABCP Platform data is at risk
- Non-security bugs, non-reproducible or speculative attacks
Known Issues – Do Not Report
- Self-XSS by store administrators
- Arbitrary file uploads to NodaCDN by store administrators
- Unverified email address changes
SQL Injection Testing Rules
Only the following SQL actions are allowed:
- Reading database name/version/user/hostname
- Retrieving schema/table/column info.
Other actions require prior approval.
File Read/Write Testing Rules
Disallowed actions include:
- Modifying or deleting files (except your own test account)
- Uploading large or malicious files
- Reading is limited to safe files like /etc/passwd, unless explicitly allowed
How to Report
Send a detailed description to infosec@abcp.online. Include:
- Steps to reproduce the issue
- Any tools or scripts used
- Impact assessment if available
- Mitigation recommendations
Rewards
We may offer a token of appreciation or public acknowledgment for valuable reports.