Superbank Security
Help us keep banking super safe.
We welcome responsible security research that helps us protect our customers, partners, and the Superbank experience.
Report a security issueVulnerability Disclosure Program
Build a safer way to bank, together.
Superbank invites independent security researchers to responsibly disclose vulnerabilities in our in-scope applications and digital assets.
Vulnerability Disclosure Program Scope and Rewards
Know what is in scope.
Only test assets explicitly listed below. Assets not listed are out of scope unless the Superbank Security Team adds them in writing.
In scope
In-scope assets
- Web applications: all Superbank-owned web assets under
*.superbank.idand*.super-id.net. - Android application: official Superbank mobile application.
- iOS application: official Superbank mobile application.
Program rules
Research responsibly.
If you are working on this program, you must follow all of the rules below.
You must be the first reporter of a valid vulnerability. Known issues or submissions leading back to the same root cause are duplicates.
You are not authorised to access user or company data, including personal data, except the minimum access required to validate a vulnerability.
All automated testing traffic must include a clear researcher identifier in the User-Agent using the format `VDP-<name>` and must be rate-limited to avoid service degradation. Requests that do not include this identifier may be blocked to protect platform availability. Please comply with this requirement to prevent disruption to authorised testing activities.
Denial-of-service and distributed denial-of-service attacks are prohibited.
Public or private disclosure of a vulnerability before written approval from Superbank is prohibited.
Never attempt non-technical attacks, including social engineering, phishing, or physical attacks.
You must not be a current or former Superbank employee for this public program.
Use only accounts and test data that you own or are explicitly authorised to use.
Do not brute-force credentials, guess credentials, change another user’s password, or target a specific employee, customer, or partner.
Do not leave any system in a more vulnerable state than you found it, destroy data, or download information beyond the minimum needed for your proof of concept.
Respect user privacy and confidentiality and comply with all applicable laws and regulations during the research process.
In the event of non-compliance, Superbank reserves the right to reject the report and take appropriate legal action.
Reporting terms
Report responsibly.
We encourage our customers, users, security researchers, business partners, and other individuals who interact with Superbank’s services to report suspected or identified vulnerabilities responsibly and in accordance with the terms below.
These terms set out the guidelines for submitting vulnerability reports directly to Superbank. By voluntarily submitting a report, you acknowledge and agree that:
You will act in good faith and only perform the minimum testing necessary to confirm the existence of a potential vulnerability.
You will not exploit a vulnerability, attempt to gain unauthorised access, or access, modify, delete, or exfiltrate data.
You will not disrupt, degrade, or impair the availability or performance of our systems, products, or services.
You will not disclose the vulnerability, your report, or the fact that you submitted a report to any third party or to the public without Superbank’s prior written consent.
You will promptly stop testing and notify Superbank if you unintentionally access personal, confidential, or proprietary information.
Your report is submitted voluntarily and in good faith, without any expectation of payment, compensation, or other reward.
To the extent permitted by applicable law, you assign to Superbank all rights and interests in the vulnerability report and related findings, including the right to use, reproduce, assess, and remediate them.
Prohibited activities
The following activities are strictly prohibited under this VDP:
- Exploiting vulnerabilities for personal, commercial, or financial gain.
- Attempting to obtain, use, disclose, modify, or delete personal, confidential, or proprietary information.
- Accessing or testing systems, applications, products, or services that are not owned or operated by Superbank or are outside the scope of this VDP.
- Conducting social engineering, phishing, spam, denial-of-service, distributed denial-of-service, brute-force, or resource-exhaustion attacks.
- Installing malware, creating backdoors, or introducing malicious code.
- Testing physical security controls or attempting unauthorised physical access to Superbank facilities or equipment.
- Using automated tools or testing methods in a manner that may affect the availability, stability, or performance of our systems.
- Violating any applicable laws, regulations, or third-party rights while identifying or reporting a vulnerability.
Confidentiality and personal data
Superbank treats vulnerability reports and related information confidentially. However, we may disclose information where necessary to investigate, remediate, manage, or report the vulnerability, or where required or permitted by applicable law.
By submitting your contact details and vulnerability report, you consent to Superbank collecting, using, disclosing, and processing your personal data and report information for the following purposes, where applicable:
- Communicating with you regarding your report.
- Verifying your identity and assessing the authenticity and legitimacy of the report.
- Investigating, validating, prioritising, and remediating the reported vulnerability.
- Conducting cybersecurity analytics, research, and risk assessments.
- Improving Superbank’s systems, products, services, security controls, and internal processes.
- Supporting audit activities, risk management, employee training, and internal reporting.
- Preventing, detecting, and investigating suspected criminal or unlawful activities.
- Complying with applicable legal, regulatory, and supervisory obligations, including responding to requests from regulators, law-enforcement agencies, and cybersecurity authorities.
- Protecting and enforcing Superbank’s rights, interests, and property, including obtaining legal advice and managing legal proceedings or dispute resolution.
- Carrying out other reasonable purposes related to the purposes described above.
Superbank may disclose your personal data, report, findings, and related information to its employees, professional advisers, service providers, contractors, regulators, law-enforcement agencies, cybersecurity authorities, and other related entities, where reasonably necessary to fulfil the purposes described above.
You may withdraw your consent in writing by contacting offensive@superbank.id. Depending on the nature of your request, withdrawing consent may prevent Superbank from continuing to assess, investigate, or respond to your report.
Superbank will not be responsible for any expense, damage, loss, or liability that you may incur, directly or indirectly, in connection with your activities or the submission of a vulnerability report.
Superbank’s receipt, review, or acknowledgement of a report does not constitute an admission of liability, an assurance that the report is valid, or a waiver of any rights or remedies available to Superbank under applicable laws or regulations.
How to report a vulnerability
Give us what we need to help.
If you believe you have identified a security vulnerability or issue affecting Superbank, please submit your report through the designated reporting form below this page.
Please do not include unnecessary personal, confidential, or sensitive information in your submission. If you unintentionally access such information during testing, stop immediately and notify Superbank through the designated reporting channel.
A clear description of the suspected vulnerability.
The affected product, service, application, or URL.
The steps required to reproduce the issue.
The potential impact or security risk.
Relevant screenshots, logs, proof-of-concept code, or other supporting information.
Your contact details so that we can follow up with you.
Superbank will review and address reports in accordance with our internal policies, procedures, and applicable laws. We may contact you for additional information, although we do not guarantee that every report will receive an individual response or result in a change to our products, services, or systems.
Superbank reserves the right to amend, suspend, or withdraw this VDP at any time. The latest version published on this page will apply.
We appreciate your responsible contribution to improving Superbank’s security and helping us protect our customers, systems, products, and services.
Testing boundaries
Out of scope.
The following findings and activities are not eligible for reward in this draft program.
Web applications and APIs
- Broken link or social-media hijacking.
- Tabnabbing.
- Missing cookie flags.
- Content or text injection.
- Clickjacking or UI redressing.
- Denial-of-service (DoS) attacks.
- Recently disclosed CVEs less than 30 days after patch release.
- CVEs without an exploitable vulnerability and PoC.
- Open ports or services without an exploitable vulnerability and PoC.
- Presence of autocomplete attributes on web forms.
- Vulnerabilities affecting outdated browsers or platforms.
- Self-XSS or XSS that cannot impact other users.
- Hypothetical flaws or best-practice findings without an exploitable vulnerability and PoC.
- SSL/TLS issues such as expired certificates or best-practice findings.
- Unexploitable vulnerabilities, including Self-XSS, XSS, or Open Redirect through HTTP headers.
- Missing security-related HTTP headers that do not directly lead to an exploitable vulnerability and PoC.
- Low-severity CSRF, including unauthenticated, logout, login, or product-cart updates.
- Invalid or missing SPF, DKIM, or DMARC records.
- Session-management issues such as expiration, logout-on-password-change, or concurrent-session behavior without exploitable impact.
- Information disclosure without an exploitable vulnerability and PoC, including stack traces, paths, directory listings, versions, IPs, third-party secrets, or EXIF metadata.
- CSV injection.
- Malicious file uploads such as EICAR files or executable files.
- HTTP Strict Transport Security (HSTS) findings.
- Subdomain takeover without a fully exploitable vulnerability and PoC or where not applicable to scope.
- Blind SSRF without an exploitable vulnerability and PoC, including DNS or HTTP pingbacks.
- Missing or bypassable rate limits, brute force, or CAPTCHA issues.
- User enumeration, including email, alias, GUID, phone number, or common CMS endpoints.
- Weak password policies involving length, complexity, or reuse.
- Ability to spam users through email, SMS, or direct-message flooding.
- Disclosed or misconfigured public API keys for non-sensitive services such as maps, Firebase, or analytics.
- Password-reset tokens sent through HTTP Referer to external services.
- Secrets, credentials, or information gathered from third-party assets outside Superbank control.
- Exposed secrets, credentials, or information on an asset under Superbank control that is outside program scope.
- Pre-account takeover, including account creation through OAuth.
- GraphQL introspection enabled without an exploitable impact.
- Task hijacking.
- Crashing your own application.
Mobile applications
- Missing client-side protections in mobile binaries, including SSL pinning, binary protection, code obfuscation, jailbreak/root detection, or anti-debugging controls.
- Lack of encryption on internal mobile databases or preference files.
- Exploits possible only on Android versions not supported at the time of the report.
- Exploits possible only on iOS versions not supported at the time of the report.
- Exploits possible only on a jailbroken or rooted device.
- Generic Android or iOS vulnerabilities without a Superbank-specific exploitable impact and PoC.
General restrictions
- Social engineering of staff or contractors.
- Attack scenarios requiring a man-in-the-middle (MITM) position or physical access to a victim device.
- Any issue without a reproducible, exploitable security impact and PoC.
Reward matrix
Impact matters.
Superbank will only reward the first reporter of a valid vulnerability that is in scope and reported in compliance with this policy.
Superbank only processes report reward payments via bank transfer to the registered Superbank account.
| Severity | Reward |
|---|---|
| Critical | USD 1,000–2,000 |
| High | USD 700–1,000 |
| Medium | USD 400–700 |
| Low | USD 50–100 |
Ready to report?
Tell us what you found.
Use the reporting form to provide clear reproduction steps, impact, screenshots or video PoC where applicable, and the test account or data context used.
Submit vulnerability reports through the secure reporting form.