Public bug bountyLaunched Feb 2026 · Updated 2 months ago

Auriga Retail

Commerce storefront, apps and checkout · auriga.shop

  • Accepting reports
  • Public
  • Managed triage
  • Safe harbour
Your access
Open to every researcher

Sign in with a researcher account to file a report.

Submit a report Read the rules of engagement first
Max bounty
$6,000
Avg. response
2.0 days
Reports resolved
133
Bounties paid
$168k
Researchers
51

Overview

Auriga Retail welcomes research across its storefront, shopping apps and checkout API. Anything that lets an attacker change a price, take over an account or read another customer's order is treated as critical.

Program terms

Type
Public
Rewards
Bounty · USD
Triage
Managed
Disclosure
Coordinated
Safe harbour
Offered
Status
Active

Response targets

First response
2 days
Triage decision
4 days
Resolution
30 days
Avg. first response
2.0 days

Scope

4 in · 4 out

In scope

In-scope assets
AssetTypeEnvironment
www.auriga.shopWebProduction
checkout.auriga.shopWebProduction
Auriga mobile appsMobileProduction
api.auriga.shopAPIProduction

Out of scope

Out-of-scope assets and activities
Asset or activityReason
blog.auriga.shop—
Third-party review widgets—
Denial-of-service / volumetric—
Coupon brute-forcing without impact—

Not rewarded

  • Denial of service / volumetric attacks
  • Self-XSS requiring victim-side paste
  • Missing security headers without demonstrated impact
  • Rate-limit or user enumeration without demonstrated impact
  • SPF / DKIM / DMARC configuration
  • Social engineering of staff or users
  • Best-practice reports with no security consequence

Rewards

USD · per valid finding
Rewards by severity
SeverityBounty
CriticalRCE, auth bypass, mass data exposure$6,000from $2,400
HighSSRF, stored XSS, privilege escalation$2,300from $920
MediumIDOR, CSRF on sensitive actions$560from $220
LowReflected XSS, minor info disclosure$110from $40
Final severity is set by Zerohunt triage.Ranges are per valid, in-scope finding.

Rules of engagement

5 rules

  1. Test only assets listed in scope. Never access, modify or delete data that does not belong to your test account.

  2. Use your own test accounts. Stop immediately if you encounter another user's data and report it.

  3. No denial-of-service, automated scanning at scale, or social engineering of staff or users.

  4. Report each vulnerability once, with clear reproduction steps and evidence. Duplicates are closed against the earliest valid report.

  5. Keep findings confidential until Auriga confirms a fix and agrees to disclosure. Good-faith research is authorized and will not be pursued legally.

Testing requirements

Use the test accounts issued to you. Tag automated traffic with a `X-Bug-Bounty: <your-handle>` header and keep request rates below 5/s.

Authorization

Testing is authorized only within the scope and rules on this page. Findings outside scope are not eligible and may not be protected under safe harbour.

Disclosure & safe harbour

Disclosure policy

Coordinated

Auriga Retail agrees a publication date with you once the issue is resolved.

Safe harbour

Offered

Auriga Retail will not pursue legal action against good-faith research within these rules.

Safe harbour statement
Auriga will not pursue civil or criminal action, or send notice to law enforcement, for accidental or good-faith violations of this policy. We consider research conducted under it to be authorized, lawful and helpful to the overall security of the internet. You remain responsible for complying with any other applicable laws.

Recent activity

Latest 4
  • LowReflected XSS on ?q= search paramResolved · $150
  • HighCart price manipulation via roundingResolved · $2,250
  • MediumOrder history exposed by guest token reuseAccepted
  • CriticalAccount takeover through password-reset raceResolved · $6,000
Ready to report

Found something on Auriga Retail?

Submit a structured report with steps and evidence. Managed triage reviews it, and a valid finding is rewarded by severity.

Submit a report All programs