Vulnerability Disclosure Program (VDP)

Introduction

At Digitec Galaxus AG, the security of our systems and the privacy of our customers are top priorities. As part of our ongoing efforts to fortify our systems and services and protect our users, we invite external security researchers and ethical hackers to help us identify and address security issues by reporting findings through our Vulnerability Disclosure Program (VDP).

Rules of Engagement

You must read and agree to follow the guidelines in this policy when conducting security research on our systems. If you discover, test, and report vulnerabilities in accordance with these guidelines, we will presume you’re acting in good faith.

  • Avoid violating the privacy of our users, degrading the user experience, disrupting production systems, or destroying and manipulating data.

  • Do not exploit any vulnerability beyond the extent necessary to prove its presence.

  • Do not use an exploit to compromise or exfiltrate data, establish persistent command line access, or use the exploit to pivot to other systems.

  • Do not disclose any information from the report or acknowledge the existence of a reported vulnerability to any third party without our explicit written consent.

  • Prioritize quality over quantity. Ensure that your vulnerability reports are well-researched, detailed, and reproducible.

  • Notify us as soon as possible after you discover a real or potential security issue.

Once you've established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), you must stop your test, notify us immediately, and not disclose this data to anyone else.

Scope

All publicly accessible IT systems owned by Digitec Galaxus AG are in scope.

Websites:

  • *.digitecgalaxus.ch
  • *.devinite.com
  • *.digitec.ch
  • *.galaxus.ch
  • *.galaxus.de
  • *.galaxus.at
  • *.galaxus.be
  • *.galaxus.fr
  • *.galaxus.it
  • *.galaxus.nl
  • *.galaxus.eu

Apps:

Public Repositories:

https://github.com/DigitecGalaxus

In-scope Vulnerabilities

The vulnerabilities outlined below qualify for our security program. Any design or implementation problem significantly impacting the confidentiality or integrity of user data is covered by the program.

  • Cross-Site Scripting (XSS)

  • Cross-Site Request Forgery (CSRF)

  • Server-Side Request Forgery (SSRF)

  • Server-Side Template Injection (SSTI)

  • SQL Injection

  • XML External Entity (XXE)

  • Remote Code Execution (RCE)

  • Local/Remote File Inclusions (LFI/RFI)

  • Flaws in authentication or authorization processes (e.g. Insecure Direct Object Reference (IDOR))

  • Business logic flaws with demonstrable impact (e.g. price manipulation, voucher abuse)

Out-of-scope Vulnerabilities

  • Security concerns or best practices that generally lack immediate exploitable impact

  • Social engineering (phishing, pretending to be staff, etc.)

  • Any and all kinds of physical access tests to our facilities

  • Denial of Service attacks or attacks causing service disruption

  • Email spoofing

  • Lack of jailbreak detection, binary protection, certificate pinning, obfuscation

  • Reports regarding absent HTTP security headers will be considered only if substantiated by a comprehensive proof of concept demonstrating how their absence could be exploited

  • Reports of use of libraries containing known vulnerabilities, unless there is proof indicating subsequent exploitation beyond the known vulnerabilities

  • Reports concerning insecure SSL/TLS ciphers or weak signature algorithms will be evaluated only if supported by a functional proof of concept illustrating their potential for exploitation

Safe Harbor

As long as you follow this policy, your actions will be viewed as authorized, and we will take no legal action against you. If a third party attempts to do so, we will confirm that you acted in good faith and in accordance with our rules.

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please contact us before proceeding any further.

What you can expect from us

We do not offer a paid bug bounty program; however, we will show our gratitude and provide non-monetary recognition based on the criticality and quality of your finding.

  • Initial response: Within 5 business days

  • Recognition: Coffee or beer at our Zurich offices to discuss your findings. If your finding is critical, you'll also get a badge for your community profile in our shop.

Reporting

Send your report to: vulnerability@digitecgalaxus[.]ch

We accept reports in English or German.

Please include:

  • The type of vulnerability and the affected host, URL or IP address

  • What you found, how you found it, and why it is a security issue

  • The potential impact of the vulnerability if it were exploited

  • How it can be reproduced, with step-by-step instructions

  • Screenshots, logs and/or proof of concept (PoC)

  • Your recommended remediation (if there is one)

Thank you in advance for your time and effort in helping us in our goal to keep customers secure!

Report Template

# Summary 
Type of vulnerability (e.g. XSS, IDOR) and the affected host, URL or IP address. 

# Description 
What you found, how you found it, and why it is a security issue.

# Impact
The potential impact of the vulnerability if it were exploited. 

# Steps for Reproduction
Step-by-step guide, including all necessary URLs, parameters, test accounts, etc.

# Proof of Concept
Screenshots, logs, sample requests, minimal exploit code, or other material that demonstrates the vulnerability.

# Recommended Remediation (optional)
Your suggestion for how to fix or mitigate the issue.