Although we review all reported issues on a case-by-case basis, please note that some of the reported issues with low impact may not qualify for recognition. A clear security impact must be demonstrated by any reported vulnerability. The severity of vulnerability will be evaluated based on the ease of exploitation and the impact it will have on Ather. Here are some common examples of ‘Out-of-Scope Vulnerabilities’ that typically do not warrant recognition and reward:

7.1 Web App Vulnerabilities:

Denial of Service (DOS) and Distributed Denial of Service (DDoS) attacks
User Enumeration on Login Forms/Forgot Password functionality
Older versions of software/plugins/third-party libraries
Vulnerabilities related to SPF/DMARC/DKIM records
Vulnerabilities related to HTTP security headers and methods
Phishing and social engineering of Ather employees, vendors, and users
Anything related to SSL/TLS protocol
Any exploit that requires user interaction
Cross-Site Request Forgery (e.g: Login, Logout )
Cross-Site Scripting (e.g. Self XSS), Clickjacking
Disclosure of known public files or directories
Injection vulnerabilities (e.g. Host header injection etc.)
Brute forcing or bypassing any mechanism (e.g. Captcha using browser add-on)
Any vulnerability that requires physical device access
Vulnerability submission on third-party products, services, and/or applications not owned by Ather
Vulnerabilities involving any compromised/stolen data (credential, coupon, etc.)
Path disclosure of internal server file
Hypothetical subdomain takeovers without supporting evidence
Any vulnerability related to rate limit
Vulnerability related to cookie attributes
Price manipulation without a successful transaction
Open Redirect, URL Redirection leading to phishing
Open Ports/Services

7.2 Out-of-Scope vulnerabilities for mobile applications (Android/IOS)

Missing certificate pinning
Exploits that require rooted/jailbroken devices
Lack of obfuscation and binary protection
Vulnerabilities in third-party libraries.
Weak Encryption/Encoding Mechanism utilised without exploitation
Vulnerabilities in WebView Feature
Crashes due to malformed URL Schemes
Lack of runtime exploit mitigation techniques