SecurityBug bounty program
Find what we missed.
We hold data people trust us with, from personal details to payment information. If you find a way in that shouldn't exist, tell us privately. We'll fix it fast, credit you and pay you.
3,000
Top reward for a critical finding
2 days
Business days until our first reply
Safe harbor
For good-faith research that follows this policy
Rewards
We pay for real impact.
Our team sets the final severity using CVSS 3.1 and the real risk to users. A report that proves real access to sensitive data gets the top of its range.
Amounts in Saudi riyals. Findings below Low get a Hall of Fame credit.
Scope
What you can test.
In scope
- five.saCompany website
- *.five.saSubdomains we run
- Our appsApps published by Five Digital Solutions Company on the App Store, Google Play and AppGallery
- Our platformsPlatforms and APIs operated by the company
Not sure an asset is ours? Ask us at security@five.sa before testing.
Out of scope
- Third-party services we use, such as payment, hosting and email providers. Report those to the vendor.
- Denial of service and load testing
- Social engineering, phishing, or contacting our staff or users
- Physical attacks on our offices or devices
- Automated scanner output without a working proof of concept
- Missing security headers or SPF, DKIM and DMARC settings without a demonstrated impact
- Clickjacking on pages with no sensitive actions, self-XSS, and logout CSRF
- Issues that need a rooted or jailbroken device, or physical access to the victim's device
Rules
Test responsibly.
Do
- Use test accounts you created yourself.
- Stop as soon as you've shown the issue, and report it right away.
- Show one record to prove impact, then stop.
- Keep the details private until it's fixed and we've agreed on a disclosure date.
- Delete any data you obtained once the report is closed.
Don't
- Don't access, change or keep other users' data.
- Don't make real payments or orders, and don't contact real users.
- Don't run denial-of-service attacks or heavy scans. Keep automated testing under 10 requests per second.
- Don't use social engineering, phishing or physical attacks.
- Don't ask for money in exchange for not publishing. That's extortion, and we'll treat it as such.
Safe harbor
We protect good-faith research.
If you follow this policy and act in good faith, we consider your research authorized. We won't take legal action against you for it or report you to anyone. If a third party takes action against you for research that followed this policy, we'll make it clear you were working under our program.
Not sure something is allowed? Ask us first at security@five.sa
Process
From your report to your reward.
- 1
You report
Send the steps to reproduce, the impact and a proof of concept.
- 2
First reply
Within 2 business days, someone on our team confirms we have it.
- 3
Triage
Within 5 business days we confirm the issue and its severity, or explain why it isn't eligible.
- 4
Fix
We fix it, keep you updated, and you're welcome to retest.
- 5
Reward
We pay within 30 days of confirming the fix, and add you to the Hall of Fame if you want.
Report
Report a vulnerability.
Write in English or Arabic. The button opens a pre-filled email to our security team in your mail app. Nothing is sent until you press send yourself.
What we need in a report
- The affected asset and the exact URL
- Clear steps to reproduce
- The real impact and who it affects
- Proof of concept: screenshots, video or HTTP requests
Prefer to write directly?
security@five.saHall of Fame
No names yet.
The first valid report takes the first spot. We list the name or handle you choose, or nothing at all if you prefer.
security.txt
Our security contact is published in the standard format, so your tools can find it directly.
Contact: mailto:security@five.saExpires: 2027-10-27T00:00:00ZPreferred-Languages: ar, enPolicy: https://five.sa/bug-bountyAcknowledgments: https://five.sa/bug-bounty#hallCanonical: https://five.sa/.well-known/security.txtBug-Bounty: True
FAQ
Before you start.
- Who can take part?
- Anyone, from anywhere. Our employees, contractors and their families can't receive rewards.
- How are rewards paid?
- By bank transfer, once the fix is confirmed. We only ask for payment details at that point, never before.
- What if someone reported it before me?
- The first valid report gets the reward. If yours is a duplicate, we'll tell you.
- Can I publish what I found?
- Yes, after it's fixed, on a date we agree together. If we haven't fixed it within 90 days of your report, talk to us and we'll set a timeline.
- Are automated tools allowed?
- Yes, as long as you stay under 10 requests per second and don't affect the service.
- What language should I write in?
- English or Arabic, whichever you prefer.