• Please do not submit AI-generated reports. We value concise easy-to-read reports with a valid video POC. Impact claims must be demonstrable - do not extrapolate beyond what the POC shows.

• 2x Bonus Rrewards for Dark Web & Social Media Intel is not applicable for this program.

• Always conduct testing ethically and legally.

• Do not publicly disclose the vulnerability without obtaining explicit consent from Zerodha Broking Limited.

• Never attempt to access, modify, delete, or store user data.

• If using automated tools or scripts, ensure they do not cause harm or excessive traffic to our platforms.

• Use only your own accounts for testing. Do not interact with or exploit other real users' accounts.

• If you find multiple vulnerabilities, report them sequentially and not simultaneously, giving us time to respond.

• Do not conduct tests that may degrade our services or impact our users.

Vulnerability Severity Classification: (rough estimates)

P1 (Critical) - Super-user privileges, access to our infra or full codebase

P2 (High) - Access to personally identifiable information (PII) in bulk, permanent access to user accounts

P3 (Medium) - Potential to impersonate or hijack users logins

P4 (Low) - Minor security misconfigurations leading to medium to low impact

P5 (Informational) - Flaws with minimal impact or Best Practices

• Age: Participants must be 18 years or older at the time of entry.

• Affiliation: Individuals affiliated with Zerodha Broking Limited, including employees, contractors, and their immediate families, are not eligible to participate.

• Country of Residence: We accept submissions globally.

• Compliance: Researchers must be in full compliance with all terms and conditions of the Zerodha Broking Limited Bounty Initiative.

Program Specific Out-of-Scope items:

• Rate limit reports will only be considered if it causes a loss to business or customer data.

• Email Spoofing (SPF/DKIM/DMARC misconfiguration) on domains which we do not use for sending mails

• Content-Security-Policy configuration opinions

• Clickjacking on pages with no sensitive actions.

• Wordpress related reports including wp-json issues.

• SSL Pinning Bypass, Root/Jailbroken Detection bypass

• Known CVE vulnerabilities without proper proof of exploitability

• Missing flags on Cookies unless clear impact is demonstrated

• Missing HTTP security headers unless clear impact is demonstrated

• API key disclosure unless clear impact is demonstrated

General Out-of-Scope items:

• Denial of Service (DoS/DDoS) Attacks: Any attempts to disrupt the service is strictly prohibited.

• Physical Security: Physical attacks against offices, data centers, or any other physical assets.

• Third-party Platforms: Vulnerabilities in third-party components or services used by Zerodha Broking Limited but not under our direct control.

• Unconfirmed Reports: Reports without a clear proof-of-concept or lacking detailed steps to reproduce.

• Social Engineering: This includes spear-phishing, pretexting, baiting, and any other form of obtaining information through deception.

• Issues related to software or protocols not under Zerodha Broking Limited control.

Carefully review and understand the rules and scope of the bug bounty program. Each program has specific guidelines, eligibility criteria, and a defined scope of systems, applications, or services that are in-scope for testing. Focus your efforts on these areas to ensure your findings are eligible for rewards.