Introduction

• At GajiGesa, we take system security very seriously and continuously work to maintain a safe and secure environment for all users. However, ensuring system security is an ongoing process, and we welcome any reports of security vulnerabilities associated with our GajiGesa services.
• GajiGesa invites skilled security researchers to participate in our Vulnerability Disclosure Program. As external security researchers, you can engage with GajiGesa by reporting any vulnerabilities to us in accordance with our Responsible Disclosure Policy. GajiGesa reserves the right to validate the reports’ validity based on the impact of the vulnerability.

Policy

• GajiGesa genuinely values the assistance of security researchers and others in the security community to help keep our systems secure. However, we insist that researchers follow the rules set out in this Responsible Disclosure Policy when reporting a security vulnerability to us.
• Reach out to [email protected] if you have found any potential vulnerabilities in our product and infrastructure that meet the criteria mentioned in the policy below.
• Our security team will acknowledge your submission within 24 hours.
• GajiGesa will define the severity of the issue based on its impact and ease of exploitation.
• We may take 3 to 5 days to validate the reported issue.
• Please refrain from accessing sensitive information (by using a test account and/or system), performing actions that may negatively affect other GajiGesa users (such as denial of service), or sending reports from automated tools.
• You must not exploit a security vulnerability that you discover for any reason.
• Perform research only within the scope set out below.
• As a researcher, you are not permitted to access, download, or modify data residing in any other account that does not belong to you or attempt to do any such activities.
• Keep information about any vulnerability confidential until the issue is resolved. Do not publicly disclose details of a security vulnerability that you have reported without GajiGesa’s permission.
• GajiGesa commits to publicly acknowledge and recognize your responsible disclosure on our Hall of Fame page.
• GajiGesa determines recognition in the Hall of Fame based on a variety of factors, including (but not limited to) impact, ease of exploitation, and quality of the report. Note that extremely low-risk vulnerabilities may not qualify for the Hall of Fame at all.
• In the event of duplicate reports, we give recognition to the first person to submit a vulnerability. (GajiGesa determines duplicates and may not share details on the other reports).
  

Reporting Guidelines

• To register yourself after identifying a vulnerability, please send an email to [email protected] with the details.
• After registration, please only use the registered email ID when interacting with the GajiGesa security team. Do not use personal emails, social media accounts, or other private connections to contact a member of the security team regarding vulnerabilities or any program-related issues, unless instructed to do so.
• In your report, please provide the following details:
  • Description and potential impact of the vulnerability;
  • A detailed description of the steps required to reproduce the vulnerability;
  • Screenshots and video POC, if available;
  • Your preferred name/handle for recognition in our Security Researcher Hall of Fame.
    
    

Target Scope

• Only the following domains are included in the scope of this program, and researchers are recommended to look for security vulnerabilities within them:
  • *.gajigesa.com
    
• Exclusion of Third-Party Software
  • As part of providing services to its customers, GajiGesa uses integrations with various third-party software. This program does not extend to any such third-party software, and bugs or vulnerabilities detected in such third-party software will not be considered a valid find. Nonetheless, any such vulnerabilities communicated to GajiGesa may be further transmitted/informed to the third-party service provider.
    
    
• In-Scope Vulnerabilities
  • Remote code execution (RCE)
  • Able to bypass payment flow
  • Account takeover attack (ATO)
  • Price manipulation with a successful transaction (transaction id required)
  • SQL/XXE Injection and Command injection
  • Stored Cross-Site Scripting and impactful Reflected XSS
  • Server-side request forgery (SSRF)
  • Misconfiguration issues on servers and application
  • Authentication and Authorization vulnerabilities including horizontal and vertical escalation
  • Cross-site request forgeries (CSRF)
  • Sensitive information leak and IDOR
  • Domain take-over vulnerabilities
  • Any vulnerability that can affect the GajiGesa Brand, User (Customer/Merchant) data, and financial transactions
    
    
• Out-of-Scope Vulnerabilities
  • Social engineering (including phishing) with any GajiGesa staff or contractors
  • Denial of Service, Distributed-DoS
  • X-Frame-Options related, missing cookie flags on non-sensitive cookies;
  • Missing security headers that do not lead directly to a vulnerability (unless you deliver a PoC)
  • Version exposure (unless you deliver a PoC of working exploit)
  • Directory listing with already publicly readable content
  • HTML injection and Self-XSS
  • Information disclosure not associated with a vulnerability, i.e.: stack traces, application or server errors, robots.txt, etc
  • Use of known-vulnerable libraries without proof of exploitation such as OpenSSL
  • Log-in or forgotten password page brute forcing and account lockout not being enforced
  • Application denial of service by locking user accounts
  • Reports from automated scripts or scanners
  • Clickjacking and issues only exploitable through clickjacking
  • No / weak captcha/captcha bypass
  • SSL issues such as BEAST, BREACH, renegotiation attack, forward secrecy not enabled, weak/insecure cipher suites, and missing best practices
  • HTTP TRACE or OPTIONS methods enabled
  • Login/logout CSRF
  • Open ports without an accompanying proof-of-concept demonstrating vulnerability
  • Reflected XSS (unless you deliver a PoC showing impact)
  • Formula Injection or CSV Injection
  • EXIF data not stripped on images
  • Rate limiting
  • Missing HTTP security headers and cookie flags on insensitive cookies
  • Email – issues related to SPF/DKIM/DMARC
  • User email enumeration
  • GajiGesa reserves its right to expand this list and includes additional exclusions when required.

Acknowledgments

• We do not offer a bounty or cash reward program for security disclosures, but we express our gratitude to security researchers publicly. As a gesture of appreciation and goodwill, we will add your name to our list of `Hall Of Fame` mentioned below.
• If you want to be recognized, please provide us with your name, Twitter handle, or LinkedIn profile as you wish it to be displayed on our Hall of Fame listing.

Hall of Fame