Amartha Bug Bounty Program
Amartha’s official Bug Bounty Program invites security researchers to identify and responsibly disclose security vulnerabilities. Together, we help protect the security of financial platforms serving millions of people across Indonesia.
REWARD CARD
ABOUT THE PROGRAM
PT. Amartha Mikro Fintek (Amartha)
Amartha is a technology company building digital financial infrastructure for the grassroots economy.
Founded in 2010, Amartha connects grassroots communities to the growing digital economy through lending, funding, and payment services.
We invite security researchers, ethical hackers, and security professionals to help strengthen our cybersecurity defenses by identifying vulnerabilities, so we can continue to secure and improve our applications and prevent exploitation by malicious actors.
Amartha is a technology company building digital financial infrastructure for the grassroots economy.
Founded in 2010, Amartha connects grassroots communities to the growing digital economy through lending, funding, and payment services.
We invite security researchers, ethical hackers, and security professionals to help strengthen our cybersecurity defenses by identifying vulnerabilities, so we can continue to secure and improve our applications and prevent exploitation by malicious actors.
Target & Scope
Any asset not explicitly listed as in-scope below is considered out of scope by default including subdomains, staging/internal environments, or third-party services connected to Amartha.
1
In Scope:
- AmarthaFin — Android
- AmarthaFin — iOS
- Website (amartha.com)
- All features/menus available within AmarthaFin are in scope. Testing must be performed on the latest app version.
2
Out of Scope:
Anything outside the three in-scope targets above is considered out of scope by default including but not limited to other subdomains, staging/internal/development environments, and third-party services or integrations connected to Amartha.
Please follow these rules to ensure your findings are eligible for a reward
1
You must be the first to report a finding/vulnerability. In case of duplicates, only the first report is eligible for a reward.
2
Reports with insufficient detail to reproduce the issue will not qualify for a reward. The more detailed your report, the faster we can triage and remediate it.
3
Leaked secrets or keys are not automatically considered valid findings. You must include documented proof-of-concept and evidence of actual impact (e.g., impacted services, potential data leaks, or other business impacts).
4
Multiple vulnerabilities originating from the same root cause will be counted as a single rewardable finding.
5
Chained vulnerabilities (combining multiple minor flaws into a single exploit) will be counted as one finding. The highest severity level in the chain will determine the reward amount.
6
Reproduction must be possible from the public side without requiring internal access, special credentials, or backend access unavailable to an external user/attacker.
7
Vulnerabilities must fall under the qualifying category (see below). Non-qualifying vulnerabilities will not receive a reward.
* Your report must include:
- A clear textual description of the finding, including vulnerability details and potential impact if exploited
- Proof of Concept (PoC) steps to reproduce the finding
- Required attachments such as screenshots or PoC code
- Other relevant supporting information
- Outgoing network traffic to a data broker
- Remote Code Execution (RCE)
- Horizontal & vertical privilege escalation
- Insecure Direct Object References (IDOR)
- Business logic vulnerability with real security impact
- Cross-Site Scripting (XSS)
- Code injection (SQL, PHP, etc.)
- Local file access & path manipulation (LFI, RFI, XXE, SSRF, XSPA)
- Broken authentication & session management
- Broken cryptographic implementation with a working exploit
- CORS misconfiguration with real security impact
- Hypothetical flaws or best-practice recommendations without an exploitable PoC
- Automated scanner reports that have not been manually validated
- Claims of outdated/vulnerable software without a PoC
- Open ports without a PoC demonstrating real impact
- Exposed login/admin panel without evidence of real-world impact
- Issues that only affect outdated devices/browsers/platforms
- Vulnerabilities that have already been publicly disclosed (recently disclosed)
- Non-sensitive info disclosure (stack trace, path disclosure, directory listing, software version)
- Issues requiring physical access to a user's device/email
- Social engineering & credential stuffing, unless accompanied by concrete evidence (PoC, request logs, screenshot/recording) showing real, reproducible impact
- Brute force that cannot be demonstrated within a reasonable time
- Simple enumeration/account oracle
- Weak password policy & SSL/TLS best practices
- 'HTTP Host Header' XSS / 'Self' XSS, text/HTML injection
- CSRF on logout & other low-severity CSRF
- Non-chained open redirect, CSV injection
- Clickjacking/UI redressing, missing security headers without direct impact
- Missing autocomplete/cookie flag, mixed content, protocol mismatch
- RTLO, homograph attacks, DoS (except from a logical flaw)
- Rate limiting without security impact, SPF/DKIM/DMARC issues
- Crashing your own application instance
- Lack of SSL pinning/binary protection/jailbreak & root detection
- Generic Android/iOS vulnerabilities, exploits that only work on old OS versions or jailbroken/rooted devices
Rewards
Validated and accepted reports will receive a reward based on the assigned severity. The rating is determined by a combination of the CVSS v4.0 base score and related business risk.
| Severity | Rewards |
|---|---|
| 9.0 – 10.0 Critical | AmarthaFin Poket Balance top-up of Rp 3,000,000 + Certificate of Appreciation |
| 7.0 – 8.9 High | AmarthaFin Poket Balance top-up of Rp 1,500,000 + Certificate of Appreciation |
| 4.0 – 6.9 Medium | AmarthaFin Poket Balance top-up of Rp 500,000 + Certificate of Appreciation |
| 0.1 – 3.9 Low | Certificate of Appreciation |
| 0.0 None | No Reward |
* Critical, High, and Medium rewards are disbursed as a top-up to the AmarthaFin Poket Balance of the account registered with the email/phone number you provided on the report form — make sure that email/phone number is already linked to your AmarthaFin account.
PII / SPI Data
Classification follows Law No. 27 of 2022 on Personal Data Protection (UU PDP) and financial industry best practices. The more sensitive the exposed data category, the higher the assigned severity.
General Personal Data:
• Full name
• Gender
• Nationality
• Marital status
• Combinations of data that can directly identify a person (e.g., address + date of birth)
Specific Personal Data (higher protection — Art. 4(2) UU PDP):
• National ID (NIK/KTP) number & Family Card (KK) number
• Biometric data (KTP photo, selfie/liveness verification, fingerprint)
• Personal financial data (balance, transaction history, loan amount/status, credit score)
• Bank account number & debit/credit card number
• Health data & children's data (where relevant, e.g. for micro-insurance/dependent claims)
• Criminal/legal records
Additional identifiers (KYC / financial industry best practice):
• Tax ID (NPWP)
• Passport Number
• Phone Number
• Email Address
• Place & Date of Birth
• Mother's Maiden Name
• Authentication credentials (password, PIN, OTP, session token, API key)
General Personal Data:
• Full name
• Gender
• Nationality
• Marital status
• Combinations of data that can directly identify a person (e.g., address + date of birth)
Specific Personal Data (higher protection — Art. 4(2) UU PDP):
• National ID (NIK/KTP) number & Family Card (KK) number
• Biometric data (KTP photo, selfie/liveness verification, fingerprint)
• Personal financial data (balance, transaction history, loan amount/status, credit score)
• Bank account number & debit/credit card number
• Health data & children's data (where relevant, e.g. for micro-insurance/dependent claims)
• Criminal/legal records
Additional identifiers (KYC / financial industry best practice):
• Tax ID (NPWP)
• Passport Number
• Phone Number
• Email Address
• Place & Date of Birth
• Mother's Maiden Name
• Authentication credentials (password, PIN, OTP, session token, API key)
aSubmit a Vulnerability Report
Report your finding through the official form below. Include a description, PoC, your claimed severity, and supporting attachments as outlined in the guidelines above.
Hall of Fame
Security researchers whose findings have been validated and accepted through this program, listed by name/handle and severity found.
Timotius Benhur
@uzet1337
Alvin Ferdiansyah
@vibonacci
Chiron
@chiron
Pass The Bug
@passthebug
Nayya Pradana
@gegezy
Fadilah Agung Nugraha
@pengelana
Rafi Andhika Galuh
@rafipiun
Rohmat Ario W
@ariotube
rivi
@bugbounty
Emiliano Jossie
@anyujin
* Data migrated from the previous bug bounty program history (findings with Resolved status).
The Hall of Fame will be updated periodically with new findings.