Bug Bounty & Vulnerability Disclosure Policy

At Poppy Mobility, we consider the security of our systems and the data of our users to be of paramount importance. We welcome the security community's help in identifying potential vulnerabilities and offer compensation for impactful findings.

This policy outlines our rules of engagement, reward structure, and what we expect from you.

1. Safe Harbor

If you conduct your security research and vulnerability disclosure in good faith and in compliance with this policy, we will consider your actions authorized. We will not initiate legal action or law enforcement investigations against you related to your research.

2. Guidelines and “Do No Harm”

We require that all researchers strictly adhere to the following guidelines:

Avoid disruption: Do not disrupt our services or perform Denial of Service (DoS/DDoS) attacks.
Protect data: If you encounter user data, stop immediately. Do not view, alter, save, store, transfer, or otherwise access data that does not belong to you.
No social engineering: Do not attempt phishing, spamming, or social engineering against our employees, contractors, or customers.
No physical testing: Physical attacks against our offices, vehicles, data centers, or employees are strictly forbidden.

3. Quality of Reporting (Anti-Spam Policy)

We do not accept raw output from automated scanners or AI-generated reports of theoretical vulnerabilities.

To ensure your report is reviewed and eligible for a bounty, your submission must include:

A clear Proof of Concept (PoC): Step-by-step instructions allowing us to manually reproduce the vulnerability.
Demonstrated Impact: A brief explanation of the practical business or security impact.
Safe Exploitation: Demonstrate the flaw safely (e.g., using a harmless payload like triggering a simple alert box, or accessing a safe test file).

Reports lacking a manual Proof of Concept or consisting solely of automated scanner output will be closed and are not eligible for compensation.

4. Scope

In Scope

*.poppy.be
*.poppy.red
Mobile App
Any other specific apps, APIs, or infrastructure

Out of Scope

Third-party services or vendors we use (e.g., our hosting provider or CRM).
Clickjacking on pages with no sensitive actions.
Missing security headers that do not lead directly to a vulnerability.
Best-practice configurations without a demonstrable exploit.

5. Bounties and Rewards

We reward researchers based on the severity of the vulnerability, determined at our discretion using CVSS-based scoring principles and actual business impact.

Severity (Score)	Reward
Exceptional (9.5 – 10.0)	2,500 EUR
Critical (9.0 – 9.4)	1,500 EUR
High (7.0 – 8.9)	500 EUR
Medium (4.0 – 6.9)	Poppy Credits
Low (0.1 – 3.9)	Poppy Credits

Note: Duplicate reports are not eligible for a bounty. The first researcher to submit a valid, reproducible PoC will receive the reward.

6. How to Report and Validation Timelines

Please send your vulnerability reports to: security@poppy.be

Mandatory Encryption: You must encrypt the contents of your vulnerability report to protect sensitive information. Please use the following PGP public key:

Once your submission has been received and verified to include a valid PoC, we will validate the vulnerability according to the following timelines:

Vulnerability Severity	Time to Validate
Exceptional	5 working days
Critical	5 working days
High	10 working days
Medium	20 working days
Low	20 working days

We ask that you maintain strict confidentiality and do not disclose the vulnerability publicly until we have deployed a fix and given explicit permission.