TATA Motors Security Research Program

Program Type: Private
Launched On: Nov. 29, 2024
Paused

Tata Motors is committed to ensuring the security and integrity of our services. As part of this commitment, we are launching the Tata Motors Security Research Program. Through this program, we encourage security researchers to responsibly disclose any potential vulnerabilities they find on our platforms, thereby contributing to our continuous drive to enhance the safety and security of our systems.

Total Submissions

100

Researchers

11543

Unique Visitors

737

Submission Rate

0.71%

TATA Motors

TATA Motors is committed to ensuring the security and integrity of our services protecting the information from unwarranted disclosure. This policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us. This policy describes what systems and types of research are covered under this policy, how to send us vulnerability reports. We want security researchers to feel comfortable reporting vulnerabilities they’ve discovered – as set out in this policy – so we can fix them and keep our users safe. We have developed this policy to reflect our values and uphold our sense of responsibility to security researchers who share their expertise with us in good faith.

2X Rewards for Dark Web & Social Media Intel
Certificate of Achievement

Earn Recognition for Your Contributions

This program awards certificates to researchers for their significant contributions and achievements. Researchers can be granted a certificate for their accepted reports by the organization, recognizing their effort and success.

SLA - Service Level Agreement
Severity Resolution (in days)
P1
7
P2
14
P3
20
P4
30
P5
60
Program Rules

Security researchers must not:

  • Test any system other than the systems set forth in the ‘Scope’ section above.
  • Disclose vulnerability information except as set forth in the ‘Reporting a Vulnerability’ and ‘Disclosure’ sections below
  • engage in physical testing of facilities or resources,
  • engage in social engineering,
  • send unsolicited electronic mail to TATA Motors users, including “phishing” messages.
  • execute or attempt to execute “Denial of Service” or “Resource Exhaustion” attacks,
  • introduce malicious software,
  • test in a manner which could degrade the operation of TATA Motors systems or intentionally impair, disrupt, or disable TATA Motors systems,
  • test third-party applications, websites, or services that integrate with or link to or from TATA Motors  systems, TATA Motors data, or render TATA Motors data inaccessible, or
  • use an exploit to exfiltrate data, establish command line access, establish a persistent presence on TATA Motors systems, or “pivot” to other TATA Motors systems.

Security researchers may:

  • View or store TATA Motors nonpublic data only to the extent necessary to document the presence of a potential vulnerability.

Security researchers must:

  • cease testing and notify us immediately upon discovery of a vulnerability,
  • cease testing and notify us immediately upon discovery of an exposure of nonpublic data, and
  • purge any stored TATA Motors nonpublic data upon reporting a vulnerability.
Eligibility to Participate
  • Age: Participants must be 18 years of age or older at the time of entry.
  • Affiliation: Individuals affiliated with TATA Motors, including employees, contractors, and their immediate families, are not eligible to participate.
  • Country of Residence: we accept submissions globally.
  • Compliance: Researchers must be in full compliance with all terms and conditions of the TATA Motors Bounty Initiative.
Out of Scope
  • Denial of Service (DoS/DDoS) Attacks: Any attempts to disrupt the service are strictly prohibited.
  • Physical Security: Physical attacks against offices, data centers, or any other physical assets.
  • Third-party Platforms: Vulnerabilities in third-party components or services used by TATA Motors but not under our direct control.
  • Social Engineering: This includes spear-phishing, pretexting, baiting, and any other form of obtaining information through deception.
  • Clickjacking on pages with no sensitive actions.
  • Issues related to software or protocols not under TATA Motors control.
  • Unconfirmed Reports: reports without a clear proof-of-concept or lacking detailed steps to reproduce.
Follow the Rules and Scope

Carefully review and understand the rules and scope of the bug bounty program. Each program has specific guidelines, eligibility criteria, and a defined scope of systems, applications, or services that are in-scope for testing. Focus your efforts on these areas to ensure your findings are eligible for rewards.


Provide Detailed Reports

When reporting a vulnerability, commit to providing clear and comprehensive details to help the organization reproduce and validate your findings. Include step-by-step instructions, proof-of-concept code if applicable, and any other relevant information that can assist the organization's security team in understanding and verifying the issue.


Collaborate Professionally

Engage in professional communication with the organization's security team. Be responsive to any requests for clarification, additional information, or coordination during the vulnerability verification process. Maintain open and respectful communication throughout the entire process, understanding that both parties are working together to improve security.


Responsible Disclosure

Always adhere to responsible disclosure practices. When you discover a vulnerability, avoid exploiting it for malicious purposes or sharing it with unauthorized parties. Instead, immediately report the vulnerability to the program organizers following the reporting process outlined in the program guidelines. This allows the organization to address the issue before potential harm can occur.


Safe Harbor

Researchers participating in our programs are expected to adhere to specific Safe Harbor provisions. They are assured Legal Protection; by complying with all program terms, they're granted a legal safe harbor, ensuring they won't face lawsuits or legal actions for their reported findings. Participants also commit to Responsible Disclosure, providing ample time to address and rectify vulnerabilities and doesn't disclose any findings publically what so ever. Testing should be confined only to systems they have explicit authorization to assess. Furthermore, during the assessment, data access should be minimized, focusing only on what's necessary to validate a vulnerability, and retaining no user data beyond what is absolutely required.