Security & Bug Bounty Program

1. Introduction

This program is owned by Rabbit’s Security team, led by Mayada Abdelsalam, Security Lead. Contact: security@rabbitmart.com.

2. Response targets

Business days are Sunday to Thursday, Cairo time.

3. Scope

Only the assets listed below are in scope. If an asset isn’t listed, it’s out of scope, even if it uses a Rabbit domain.

In scope

Out of scope

• Staging, development and test environments.
• Payment providers, including Paymob, and other third parties. Report issues in their systems to them directly; bugs in Rabbit’s integration with them are in scope.
• Rabbit’s corporate and warehouse networks, VPN gateways, and internal admin or warehouse management systems.
• Port scanning, network sweeps or brute-force attacks against any Rabbit IP range.
• Social engineering or phishing of Rabbit employees, riders, pickers, customers or support staff.
• Physical security of Rabbit offices, dark stores or warehouses.
• Denial of service (DoS/DDoS) and any testing that degrades service.
• Issues affecting only outdated or unpatched browsers and platforms.
• Issues already known to Rabbit and in fix phase. Reports matching a known issue are treated as duplicates and are not rewarded.

4. Testing rules

• Identify your traffic. Add the header X-Bug-Bounty: <your-handle> to every request so we can tell your testing apart from an attack.
• Keep traffic low. Send no more than 5 requests per second. Don’t use automated scanners that generate heavy traffic.
• Don’t affect real orders or riders. Never complete a real paid order, request a real delivery, or contact riders, pickers or support staff as part of testing. Cancel any order you create right away.
• Don’t keep what you gain. If a bug gives you money, credit, discounts or free products, don’t use them. Stop and report it.
• Stop at proof. Show the minimum needed to prove impact. Don’t pivot further into our systems, change or delete data, or keep access.
• One issue per report, unless you need to chain issues to show impact.
• Duplicates: only the first fully reproducible report of an issue is rewarded. Several bugs with one root cause receive one reward.
• If you find an issue in something that isn’t listed in scope, you may still report it. It’s unlikely to be eligible for a reward, so please don’t go looking for these.

5. Personal data, safe harbor and disclosure

Personal data. Rabbit processes personal data under Egypt’s Personal Data Protection Law (Law No. 151 of 2020). If you access personal data of any user (for example names, phone numbers, addresses or order history):

• Stop at once and report it.
• Access only the minimum needed to prove the issue; never download, export or keep it.
• Delete anything you accessed once you have sent your report, and confirm the deletion to us.
• Never access users’ private messages or communication preferences.

Safe harbor. If you act in good faith and follow this policy, Rabbit considers your research authorized. We will not pursue legal action against you or report you to law enforcement, including under Egypt’s Anti-Cyber and Information Technology Crimes Law (Law No. 175 of 2018). If a third party takes legal action over activity that followed this policy, we will make it known that your actions were authorized. Safe harbor does not apply if you intentionally cause harm, access more data than needed, or break these rules.

Coordinated disclosure. Please don’t share details of a vulnerability publicly until it’s fixed. Once it’s fixed, you may publish on a date we agree with you. We’ll gladly credit you on request.

6. Eligibility

To receive a reward, you must:

• Be at least 18 years old.
• Not be a current or former (within the last 12 months) Rabbit employee, contractor or vendor, or a family member of one.
• Not be on any sanctions list, or live in a country where we can’t legally pay you.
• Be the first to report the issue and follow every rule in this policy.

7. Rewards

The reward depends on the CVSS v3.1 score and the real business impact on Rabbit, such as how many customers are affected and whether money or personal data is at risk. Amounts are in US dollars and are paid in the Egyptian pound equivalent at the Central Bank of Egypt rate on the payment date.

Rabbit decides the final severity and amount. A report without clear steps to reproduce the issue isn’t eligible for a reward.

8. Findings that don’t qualify

These are usually not rewarded unless you show real impact:

• Missing security headers or cookie flags with no demonstrated exploit
• Clickjacking on pages with no sensitive actions
• SPF, DKIM or DMARC configuration
• Self-XSS, or attacks that require the victim to paste code
• Software version disclosure, banners or stack traces with no sensitive data
• Rate-limit issues on non-sensitive endpoints (rate-limit bypass on login, OTP or coupon endpoints is in scope)
• SSL pinning bypass or root/jailbreak detection bypass on your own device, unless chained to a real attack
• Reports produced only by automated scanners, without proof
• Issues in third-party services that are out of scope
• Vulnerabilities in pages or apps that are no longer supported

9. How to report

Send your report to security@rabbitmart.com in English or Arabic. Don’t include other users’ personal data beyond the minimum needed to show the issue.

Please include:

1. Title and a short description of the issue and its impact
2. The affected asset (URL, API endpoint or app version)
3. Step-by-step instructions to reproduce it
4. Requests and responses, screenshots or a short video
5. Proof-of-concept code, if any
6. Any account IDs you used, the X-Bug-Bounty handle and your IP address during testing
7. Your CVSS v3.1 vector and a suggested fix, if you have one

We’ll reply only from an @rabbitmart.com address. Treat any other address claiming to be Rabbit Security as suspicious.

10. Policy updates

Version 1.0, effective November 2026. We may update this policy; check it before each engagement. The version that applies is the one in force when you start testing, and changes are listed below.