Bug Bounty Program

DMarketplace is a marketplace for gift cards, eSIMs, digital and physical products paid with crypto. Customers buy in our shops, merchants sell through the merchant panel, and our API handles orders, payments, the delivery of codes and the shipping of physical products.

This program rewards security researchers who report vulnerabilities in these services before anyone exploits them: up to 200 USD in $DMP for every valid report.

Severity levels

We rate every valid report by impact and likelihood so we can fix the most serious issues first. The amount of the reward, up to 200 USD in $DMP per report, depends on the severity and the quality of the report.

What counts for the rating includes: how much money or data is affected, how many users are affected, whether an attacker needs an account of their own or special privileges, and how complex the attack is.

Reward

We pay up to 200 USD in $DMP for every valid report, depending on its severity and quality. A report is valid if it describes a security vulnerability in scope that we did not already know about, if we can reproduce it with your steps or proof of concept, and if you followed the rules on this page.

• If several reports describe the same issue, only the first complete report receives the reward. Several issues with the same root cause count as one report.
• We decide whether a report is valid, in scope or a duplicate, and let you know our decision by email.
• We pay in $DMP, our token on Ethereum mainnet (see /our-token): DMP worth up to 200 USD at the DMP price on the day of payout. Once we have confirmed the issue, we send it to an Ethereum wallet you name.
• We cannot pay where the law does not allow it, for example because of sanctions. Employees and contractors of dMarketplace Inc. are not eligible.
• Breaking the rules on this page or disclosing an issue early means no reward.

Scope

This policy covers the following services of dMarketplace Inc.:

• our shops at dmarketplace.ai, dmarketplace.de and dmarketplace.co.uk
• our API at api.dmarketplace.ai
• the merchant panel at merchants.dmarketplace.ai
• our admin panel

Out of scope

The following are not rewarded:

• Third-party services we use, such as the Request Network payment page, wallet apps or gift card issuers and their redemption websites, are not covered. Please report vulnerabilities in those services to the provider concerned.
• issues we already know about or that someone else has already reported
• theoretical issues without a working proof of concept, and output of automated scanners without a demonstrated, reproducible impact
• content errors, typos or outdated texts
• manipulation that only changes what your own browser shows, without any effect on our servers or on other users’ data
• missing security headers, cookie flags, SPF, DKIM or DMARC records and other best practices without a demonstrated impact
• self-XSS, clickjacking on pages without sensitive actions, and logout CSRF
• rate-limit tests, load tests and denial-of-service tests
• social engineering (for example phishing) aimed at our team, merchants or customers
• attacks that require physical access to a device or an already compromised device, account or wallet
• vulnerabilities in third-party blockchains, wallets or smart contracts

Rules for testing

When you examine our services, please follow these rules:

• Use only accounts and data that belong to you. Do not access, change or delete other people’s data. If you come across someone else’s data by accident, stop, do not keep or share it, and mention it in your report.
• Do not disrupt our services or degrade them for others, for example through load tests, mass requests or spam.
• Go only as far as needed to demonstrate the issue, and do not exploit it any further, for example to obtain gift card codes or money.
• Keep your findings confidential until the issue has been fixed.

Prohibited actions

The following are strictly prohibited:

• attempting to access other users’ private data
• social engineering or phishing
• denial-of-service attacks, load tests and spam
• attacks on the infrastructure of our providers, such as Google Cloud or Cloudflare
• exploiting an issue beyond the proof, for example redeeming codes or keeping money
• any testing that violates applicable laws
• threats or demands, for example making the report conditional on a payment

Disclosure

Report issues only to us by email, and do not make them public until

• we have confirmed the issue,
• the issue has been fixed, and
• we have explicitly agreed to the publication.

Our safe harbor statement at /security applies to research under this program.

How to report

Send your report by email to support@dmarketplace.ai. Please include:

• the affected URL, page or API endpoint
• a description of the vulnerability and its possible impact
• the steps to reproduce it, for example requests, screenshots or a short video
• when you tested and which of your own accounts you used, if any
• a proof of concept with instructions on how to run it

Please do not include other people’s personal data. We review every report and contact you by email if we need more information.

We only need your Ethereum wallet address for the DMP payout once we have confirmed the report.