Skip to main content

Upstox Bug Bounty Program

Found a bug on our platform? Report it and get rewarded. Driven by tech, but led by people Upstox believes in maintaining the highest levels of security at all times. And to do that we need your help. Scrutinize, search and send us reports on any bugs you find on our app or web platform, and together lets bug it out!

Submit vulnerability *

*Gmail account is required to submit the vulnerability

Upstox Bug Bounty Program

Bug Severity Levels

Rules of Disclosure

  1. The security researcher knows his responsibility and adheres to all ethical guidelines.
  2. The security researcher reporting the bug or members of any external organization who were/are part of the supporting development teams and their relatives are not allowed to participate in the Bug Bounty Program.
  3. The security researcher may report any security breaches and vulnerabilities found in the system or network.
  4. The security researcher should keep their discoveries confidential at all times and not disclose the vulnerability to the public or other organizations.
  5. The security researcher shall not copy, paste, share, transfer, replicate, or any such activity that would lead to data breach and shall maintain utmost precaution in handling the data shared by the Upstox and shall at all times adhere to the data security policy of the Upstox.
  6. The security researcher shall act professionally, including but not limited to testing activities, and shall not be associated with malicious hackers or malicious activities.
  7. Testing and identification of the bug should not affect any commercial/trading service at Upstox. Also, you must not break any laws to discover and identify the vulnerabilities.
  8. The use of social engineering techniques on our customers or staff is not accepted.
  9. The bugs identified in the UAT / Dev environment are not accepted.
  10. The security researcher shall always maintain data protection of all the Customers of the Upstox.
  11. The monetary reward and severity will be decided based on the criticality of the issue on a case-to-case basis.
  12. Vulnerabilities reported should be from the latest stable version.
  13. The bug must be new and not previously reported. The Upstox Security team will send a reply to you within a couple of working days if your submitted vulnerability has been previously reported.
  14. We may choose not to provide any monetary benefit if we feel the vulnerability is not critical or the submission doesn't follow any of the guidelines provided by Upstox.
  15. The program may be amended or discontinued, without notice, at any time.
  16. The bug should not be a random occurrence (i.e., it can be reproduced easily). It must be remotely exploitable by us in a standard configuration.