The security of our banking services is our top priority
Despite our continuous effort, vulnerabilities in our systems can still be present. We actively encourage anyone who believes they have discovered a vulnerability in our systems to act immediately to help us improve and strengthen the safety of our online presence.
As MONETA, we strive for the highest standards of security to keep our customers safe. We recognize how important it is to protect customer privacy and ensure their security. Therefore, we have decided to invite all ethical hackers to help us find bugs and vulnerabilities in our environment and help us improve our security. If you have any questions or would like to submit a vulnerability, please do not hesitate to contact us at bugbounty@moneta.cz.
Our bug bounty program wouldn’t be successful without the help of our external community of researchers. Thank you. See our Hall of Fame.
MONETA Money Bank, a.s. reserves the right to cancel, pause or modify this program at any time. All engagements will be honoured to the conditions in existence at the time of verification of the issue.
Let’s work on this together to keep us all safe
What errors are covered by the reward
At present, MONETA Money Bank’s bug bounty program applies to security vulnerabilities discovered in any of the following web services:
https://www.moneta.cz (no subdomains)
https://ib.moneta.cz (no subdomains)
In addition to the above-mentioned web services, MONETA Money Bank’s bug bounty program also applies to security vulnerabilities discovered in our mobile banking application Smart Banka.
We are not providing any testing accounts or environments.
For effective reporting, please follow these steps
- Send one bug per one submission at bugbounty@moneta.cz
- If possible always include at least screenshots or video to the attachment (do not upload videos to YouTube or public file sharing services)
- All PoC have to be reproducible without any special commercial tool
E-mail subject
[nameof.domain.cz (or mobile app) - type of bug - optional short clarification]
e.g.: moneta.cz - XSS reflected - parameter xyz
PoC template in body of e-mail submission
[short description of the vulnerability, name of impacted URL, IP, or app]
Detailed step-by-step manual to reproduce bug with screenshots
[commands, scripts, and codes in copy and paste format]
- First step
- Second step
- Third step
All attack scenarios and theoretical possible impacts
[you can describe some attack scenarios how bug could be used and what impact could have it]
Supporting material/references
[e.g., additional information, blogs, recommended fix, countermeasure for minimize bug impact, etc.]
Do not report errors
| Absent or partial SPF/DKIM/DMARC records |
| Absence of using HTTP Strict Transport Security (HSTS) |
| Absence of DNSSEC |
| Clickjacking on non-logon pages |
| Attacks requiring MITM to a user's device |
| Self-XSS reports |
| Vulnerabilities associated with 3rd party cookies |
| Weak Ciphers |
| Stolen credentials of MONETA clients |
| Text injection on domain without any MONETA front-end |
Responsible disclosure guidelines
| You will not send more than 100 requests to test rate limit (otherwise this bounty will not be rewarded) |
| You will not disclose the vulnerabilities found to any third party without the prior consent of MONETA |
| You will make a good faith effort to avoid property or non-material damage, privacy violations, destruction of data, and interruption or degradation of our services |
| You will not modify or access data that does not belong to you |
| You will not attempt to penetrate the system any further than required for the purpose of your investigation. Should you have successfully penetrated the system, you will not share this gained access with any others |
| You will not utilise social engineering in order to gain access to our IT systems |
| You will not utilise any brute-force techniques (e.g. repeatedly entering passwords) in order to gain access to the system |
Hall of Fame only reports
Below you can see what findings qualify for a Hall of Fame record
| Findings that have already been identified internally |
| Theoretical security issues with no practical exploit scenario |
| No impact bugs such as limited Information disclosure |
| Host header injection with no demonstrable impact |
| Missing rate limits |
| Bugs enabling denial of service attacks |
| SSL/TLS best practices without proof of exploitability |
| Login/logout cross site request forgery |
| Open ports which do not directly lead to a security vulnerability |