Belvo Bug Bounty Program

Welcome!

We're excited to invite security bug hunters from all backgrounds to help us make Belvo a more secure platform for everyone. Your expertise helps us identify vulnerabilities before they can be exploited, and we value your contributions to our security efforts.

Belvo is an Open Banking API platform that helps its customers build applications that interact with financial institutions. You can learn more at our Developer Portal and API Documentation.

Program Scope

We appreciate reports that can help us improve our security posture. Please review the following details carefully before submitting your findings.

In-Scope Assets

Any design or implementation issue that substantially affects the confidentiality or integrity of user data is likely to be considered in-scope. This includes serious security weaknesses in dependencies—such as open source libraries or third-party components—actively used in the development of our products.

Out-of-Scope Assets

Additional exclusions:

• Any services hosted by third parties, unless they directly impact the security of our primary assets.
• Physical offices and infrastructure.
• Employee social media accounts.

Vulnerabilities We're Interested In

• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF) with significant impact
• SQL Injection
• XML External Entity attacks (XXE)
• Authentication or authorization flaws / Authentication bypass
• Privilege escalation
• Insecure Direct Object References (IDOR)
• Circumvention of our permissions model
• Remote Code Execution (RCE)
• Server-Side Request Forgery (SSRF)
• Directory traversal
• Mixed-content scripts
• Security misconfigurations

This list is not exhaustive. Any report concerning the possible compromise of sensitive user data or our systems is of interest.

Vulnerabilities Out-of-Scope

Explicitly excluded:

• Clickjacking on pages with no sensitive actions
• CSRF on unauthenticated forms or forms with no sensitive actions
• Self-XSS
• Unauthenticated/logout/login CSRF
• Attacks requiring MITM or physical access to a user's device
• Mass account registration
• Any activity that could lead to Denial of Service (DoS) or service degradation
• Content spoofing and text injection without ability to modify HTML/CSS
• Vulnerabilities requiring another user's authenticated session, tokens, or physical device access
• Issues dependent on unpatched/outdated browsers or mobile platforms
• Version disclosure, detailed error messages (attacker reconnaissance only)
• Email spoofing, SPF, DMARC, DKIM issues without working proof of concept
• Hardware/CPU-related vulnerabilities (BEAST, CRIME, BREACH, Lucky Thirteen) unless exploitable through our website or API
• Password, email, and account policies (verification, reset link expiration, password complexity)
• Attacks requiring exploitation tools to overlay on our app (e.g., tapjacking)
• Social engineering of employees or contractors
• Physical attempts against property or data centers
• Presence of autocomplete attribute on web forms
• Missing cookie flags on non-sensitive cookies
• Arbitrary user deletion from team
• Broken external domain links (outside *.belvo.com) without working proof of concept demonstrating domain takeover
• Dashboard authorization issues regarding standard user deactivation or invitations (unless demonstrating ability to disable the account 'Owner' or a definitively broken authorization flow)
• Wildcards on widget flows (by design, to allow clients to use widgets seamlessly)
• Low-effort or purely theoretical reports without demonstrated impact

Excluded unless accompanied by a working, exploitable Proof of Concept:

• Known-vulnerable libraries/dependencies
• Missing best practices
• Insecure SSL/TLS ciphers
• Missing security headers (unless they directly lead to a vulnerability)
• Lack of CSRF tokens (unless a sensitive user-action is unprotected)
• Host header injections
• Reports from automated tools without manual validation
• Banner or version information (unless a medium/high/critical vulnerable version is found)

Known Issues

The following issues are already known and are out-of-scope:

• Lack of anti-CSRF token
• CORS misconfiguration
• Lack of HTTP security headers
• API keys sent over insecure channel (email)
• Account confirmation does not require reauthentication
• Lack of session expiry
• Lack of two-factor authentication
• Lack of security-related event logging for users
• Weak password policy
• [Connect widget] Lack of informed consent regarding data and operations user allows access
• Lack of Subresource Integrity (SRI)
• Lack of Strong Customer Authentication (SCA) / PSD2
• Session token cookie missing Secure and SameSite attributes
• Rate limit bypass

New reports of known issues may qualify for awards if they describe new instances not previously observed.

Rewards

Bounties are awarded based on the severity and impact of the vulnerability and quality of the report. If we receive multiple reports of the same vulnerability, the first clear, reproducible report will be rewarded.

Notes:

• We may award higher amounts for clever or more impactful vulnerabilities.
• We may award lower amounts for vulnerabilities requiring unusual user interaction.
• A single report may constitute multiple bugs, or multiple reports may warrant only a single award.
• Reports without clear security implications or that require unrealistic attack scenarios will not be rewarded.
• You are responsible for any applicable taxes associated with rewards.
• Reports from individuals we are prohibited by law from paying are ineligible for awards.

Submission Guidelines

Account & Request Identification

Researchers must create accounts with +bugbounty in their email so activity can be monitored and distinguished from legitimate traffic (e.g., [email protected]).

All requests must include the following custom HTTP header:

Header name:  type
Header value: bugbounty

Do not use or interact with accounts you do not own.

Testing Environments

Testing is performed on both production and sandbox environments. Sandbox is preferred as it does not require a real bank account; however, findings should be extrapolated to the production environment.

Report Requirements

All submissions must include the following. Reports failing to meet these standards will be closed as Informational or N/A:

1. Clear Description — A detailed description of the vulnerability and its potential business impact.
2. Step-by-Step PoC — Clear, reproducible steps demonstrating exactly how to exploit the vulnerability.
3. Evidence — Screenshots, videos, or code snippets (requests/responses, payloads/injections) where possible.
4. Remediation Advice — A detailed recommendation for how to fix the issue.
5. Manual Verification — Automated scanner results without manual verification and a working proof-of-concept will be rejected immediately.

Rate Limits & Testing Constraints

• Limit requests to no more than 10 requests per minute
• Avoid testing that triggers excessive emails or notifications (max 5 per hour)
• Limit login/authentication attempts to 10 per hour
• Avoid any testing that could impact system availability or other users

Program Rules

• Adhere to this policy and any other relevant agreements (e.g., Terms of Service)
• Bug disclosure communications with Belvo's Security Team are to remain confidential
• Automated scanning against Belvo properties is not permitted
• Threatening of any kind will automatically disqualify you from participating
• If the same bug can be replicated in multiple places or environments, it counts as one bug
• It is Belvo's decision to determine when and how bugs should be addressed
• Report vulnerabilities promptly upon discovery
• Avoid violating the privacy of others, disrupting systems, destroying data, or harming user experience
• Use only the Official Channels to discuss vulnerability information
• If a vulnerability provides unintended access to user data (PII, PHI, credit card data, proprietary information): Cease testing and submit a report immediately
• Do not engage in extortion
• Researchers will not share scripts or source code developed for Belvo security research with anyone other than Belvo's security team
• Repeatedly submitting out-of-scope or low-effort issues may result in a ban from the program

Our Commitment

We will acknowledge your report within 1-3 business days.

A resolution or update will be provided within 1-3 business days.

We will:

• Keep you informed about the status of your report
• Work with you to understand and validate your report
• Work to remediate discovered vulnerabilities in a timely manner
• Recognize your contribution if you wish to be acknowledged
• Extend Safe Harbor for vulnerability research conducted according to this policy

Official Channels

Any vulnerability deemed to be in-scope should be reported directly through the BugBop platform. All communications between the researcher and program team regarding any reported vulnerability should be confined to the comments section of the corresponding report.

Legal Safe Harbor

When conducting vulnerability research according to this policy, we consider the research to be:

• Authorized under applicable anti-hacking laws — we will not initiate or support legal action against you for accidental, good faith violations of this policy
• Authorized under relevant anti-circumvention laws — we will not bring a claim against you for circumvention of technology controls
• Exempt from restrictions in our Acceptable Usage Policy that would interfere with security research (waived on a limited basis)
• Lawful, helpful to the overall security of the Internet, and conducted in good faith

You are expected to comply with all applicable laws. If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

If at any time you have concerns or are uncertain whether your research is consistent with this policy, please submit a report before going any further.

We may modify the terms or terminate this program at any time.