{"id":1213,"date":"2023-07-13T22:02:54","date_gmt":"2023-07-13T22:02:54","guid":{"rendered":"https:\/\/use.rently.com\/?page_id=1213"},"modified":"2024-09-17T20:28:45","modified_gmt":"2024-09-17T20:28:45","slug":"responsible-disclosure","status":"publish","type":"page","link":"https:\/\/use.rentlydev.com\/?page_id=1213","title":{"rendered":"Responsible Disclosure"},"content":{"rendered":"<p>We appreciate your interest in our program for responsible disclosure. We value the help of security researchers and individuals in spotting and reporting potential flaws since we take the security of our systems and user data seriously. This program provides instructions for the proper disclosure of any identified security flaws.<\/p>\n<h2>Scope<\/h2>\n<p>Any of the Rently services iOS, Android, or Web apps, which process, store, transfer, or use in one way personal or sensitive personal information, such as card data and authentication data.<\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>Domains: <\/strong><\/td>\n<td>*.rently.com<\/td>\n<\/tr>\n<tr>\n<td><strong>iOS Apps: <\/strong><\/td>\n<td>All the iOS applications present\u00a0<a href=\"https:\/\/apps.apple.com\/in\/developer\/consumer-2-0-inc\/id1224476382\">here<\/a><\/td>\n<\/tr>\n<tr>\n<td><strong>Android Apps: <\/strong><\/td>\n<td>All the Android applications present\u00a0<a href=\"https:\/\/play.google.com\/store\/apps\/developer?id=Rently+inc\">here<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Reporting Process<\/h2>\n<h3>How to Report?<\/h3>\n<p>We ask that you responsibly submit any information involving security flaws you find in our systems promptly. We take security concerns seriously and act quickly to address substantiated security concerns. We&#8217;ll give you a spot on our Hall of Fame page as our way of saying thanks if you are the first to report a valid security issue. Anyone is welcome to send security-related reports to <a class=\"css-tgpl01\" title=\"mailto:bugbounty@rently.com\" href=\"mailto:bugbounty@rently.com\" data-testid=\"link-with-safety\" data-renderer-mark=\"true\">bugbounty@rently.com<\/a>.<\/p>\n<h3>What should be in the report?<\/h3>\n<p>When reporting a vulnerability, please include all relevant information that will allow us to understand and reproduce the issue. This should include a clear description of the vulnerability, steps to reproduce it, and any supporting materials like screenshots or proof-of-concept code.<\/p>\n<h3>Email Format:<\/h3>\n<pre>Name: %name\r\n\r\nBug type: %bugtype\r\n\r\nDomain: %domain\r\n\r\nSeverity: %severity\r\n\r\nURL: %url\r\n\r\nPoC: %poc\r\n<\/pre>\n<p>&nbsp;<\/p>\n<h2>What are the next steps?<\/h2>\n<ol>\n<li>Upon receiving your report, our security team will acknowledge the receipt <span id=\"751ee663-e110-42d6-a857-e00f23e3b08b\" data-renderer-mark=\"true\" data-mark-type=\"annotation\" data-mark-annotation-type=\"inlineComment\" data-id=\"751ee663-e110-42d6-a857-e00f23e3b08b\">within 15 days<\/span>. We will then investigate the issue and, if necessary, engage with you to gather additional information or clarify any details.<\/li>\n<li>We strongly support responsible disclosure. We ask that you hold off on making the vulnerability public until we have had enough time to look into it and fix it. We promise to keep your findings completely confidential, and we&#8217;ll cooperate with you to address the vulnerability and recognize your contribution.<\/li>\n<li>Once the vulnerability is verified and resolved, we will notify you of the fix and, if desired, provide appropriate credit for your responsible disclosure. We value your contributions and may acknowledge your efforts in our security advisories or Hall of Fame, subject to your consent.<\/li>\n<\/ol>\n<h2>Our Focus Areas<\/h2>\n<ol>\n<li>SQL injection<\/li>\n<li>Remote Code Execution (RCE) Vulnerability<\/li>\n<li>Authentication and authorization vulnerabilities, including horizontal and vertical escalation. (Use 2 different test accounts created by you)<\/li>\n<li>Domain Takeover Vulnerability<\/li>\n<li>Stored XSS, DOM XSS, Blind XSS, IDOR, SSRF<\/li>\n<li>Massive leak of sensitive user information<\/li>\n<li>Any vulnerability that could affect the Rently brand, user (customer\/seller) data, and financial transactions<\/li>\n<\/ol>\n<h2>What are not eligible?<\/h2>\n<ol>\n<li>Duplicate submissions and Known Issues<\/li>\n<li>Rate cap (unless it involves a serious data threat or loss of business)<\/li>\n<li>Third-party software such as Salesforce, Domo, WordPress on WPengine, etc.<\/li>\n<li>High severity CVEs within the last 6 months.<\/li>\n<li>0day exploits unless the product is made by Rently brands.<\/li>\n<li>Configuration and best practices such as SPF\/DMARC, missing security headers including CSP, or insecure SSL\/TLS ciphers that do not lead to an exploit.<\/li>\n<li>Information disclosure includes software version, file path, email, and IP addresses.<\/li>\n<li>PoC that solely rely on DNS lookup or HTTP request from tools such as Burp collaborator or webhook.site.<\/li>\n<li>Lack of Secure\/HTTPOnly flags and CSRF tokens on non-sensitive pages (anonymous form or logout page).<\/li>\n<li>\u00a0 Clickjacking that does not exist in our in-scope pages.<\/li>\n<li>\u00a0 Cross-domain leakage.<\/li>\n<li>\u00a0 Open redirects, unless the impact is high.<\/li>\n<li>\u00a0 Email and account policies such as reset method and password complexity.<\/li>\n<li>\u00a0 Theoretical XSS or Self-XSS attacks without evidence of exploitability, such as an input being reflected in the response.<\/li>\n<li>\u00a0 Exploits that require physical access to the victim\u2019s device.<\/li>\n<li>\u00a0 Demo and testing sites.<\/li>\n<li>\u00a0 Missing CAA title<\/li>\n<li>\u00a0 Networking issues or industry standards<\/li>\n<li>\u00a0 Disclosure of known public files or directories, (e.g. robots.txt, wpcron.php)<\/li>\n<li>\u00a0 Cacheable SSL pages<\/li>\n<li>\u00a0 Bruteforce<\/li>\n<li>\u00a0 Missing captcha<\/li>\n<li>\u00a0 Session timeouts<\/li>\n<\/ol>\n<p><strong>The following are strictly prohibited:<\/strong><\/p>\n<ol>\n<li>Do not leave any system in an unusable state. Simply leaving a text file to demonstrate you have access to the system is sufficient.<\/li>\n<li>Do not test any domain or subdomains not listed above unless authorized.<\/li>\n<li>Do not perform denial of service (DOS \/ DDOS) attacks including testing of rate limits and brute force.<\/li>\n<li>Do not perform physical attacks against our offices and data centers.<\/li>\n<li>Do not perform social engineering of our service desk, employees, or contractors.<\/li>\n<li>Do not compromise our users and employee accounts, including interacting with accounts you do not own.<\/li>\n<li>Do not exfiltrate any data.<\/li>\n<li>Do not mass-create accounts or services.<\/li>\n<\/ol>\n<p>Automated scanning tools such as Burp, Zap, Nessus, OpenVAS, etc. are allowed. However, we do not accept reports generated from scanning tools. Please also be mindful of denial of service when using those tools.<\/p>\n<h2>Legal<\/h2>\n<p>Under no circumstances should your testing and reporting of a security vulnerability affect the availability of Rently\u2019s services, violate Rently\u2019s Terms of Service, or disrupt or compromise any data that is not your own.<\/p>\n<p><em><strong>Please note that this Responsible Disclosure Program does not grant any permission to perform any testing or activities that may violate applicable laws or compromise the privacy and security of our systems and users.<\/strong><\/em><\/p>\n<p>To be eligible for the program, you must not be employed by Rently, or be a family member of a person employed by Rently.<br \/>\nRently reserves the right to modify the terms of or cancel the program at any time. In addition, this program is void where prohibited by law.<\/p>\n<h2>Important Information<\/h2>\n<p>Rently would like to thank the people who have contributed to securing our network, applications, and users. Anyone who has made a report following the guidelines in the Responsible Disclosure policy can be included in the Hall of Fame.<\/p>\n<p><em data-renderer-mark=\"true\">Thank you for your cooperation in helping us maintain the security of our systems. Your responsible disclosure is greatly appreciated.<\/em><\/p>\n<hr \/>\n<h2><\/h2>\n<h2 style=\"text-align: center;\">Hall of Fame<\/h2>\n<p>Rently would like to thank the people who have contributed to securing our network, applications, and users. Anyone who has made a report following the guidelines in the Responsible Disclosure policy can be included in the Hall of Fame.<\/p>\n<details class=\"hall-of-fame\" open=\"\">\n<summary><strong>HoF Members | 2023<\/strong><\/summary>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul style=\"display: block;\">\n<li>\n<table border=\"1px\" width=\"100%\">\n<tbody>\n<tr>\n<th style=\"color: white;\"><strong> Reporter <\/strong><\/th>\n<th style=\"color: white;\"><strong> # reports in 2023 <\/strong><\/th>\n<\/tr>\n<tr>\n<td><strong>Syed<\/strong><\/td>\n<td>1<\/td>\n<\/tr>\n<tr>\n<td><strong>Aditya Saxena<\/strong><\/td>\n<td>3<\/td>\n<\/tr>\n<tr>\n<td><strong>Anupam<\/strong><\/td>\n<td>2<\/td>\n<\/tr>\n<tr>\n<td><strong>Gokul AP<\/strong><\/td>\n<td>1<\/td>\n<\/tr>\n<tr>\n<td><strong>Derick Downss<\/strong><\/td>\n<td>2<\/td>\n<\/tr>\n<tr>\n<td><strong>Palwasha<\/strong><\/td>\n<td>1<\/td>\n<\/tr>\n<tr>\n<td><strong>Shashank Chaudhary<\/strong><\/td>\n<td>1<\/td>\n<\/tr>\n<tr>\n<td><strong>Parth Narula<\/strong><\/td>\n<td>1<\/td>\n<\/tr>\n<tr>\n<td><strong>Suraj Kumar<\/strong><\/td>\n<td>1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/details>\n<details class=\"hall-of-fame\">\n<summary><strong>HoF Members | 2022<\/strong><\/summary>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>\n<table border=\"1px\" width=\"100%\">\n<tbody>\n<tr>\n<th style=\"color: white;\"><strong> Reporter <\/strong><\/th>\n<th style=\"color: white;\"><strong> # reports in 2022 <\/strong><\/th>\n<\/tr>\n<tr>\n<td><strong>Palwasha<\/strong><\/td>\n<td>1<\/td>\n<\/tr>\n<tr>\n<td><strong>Burhan<\/strong><\/td>\n<td>6<\/td>\n<\/tr>\n<tr>\n<td><strong>Alvi Alex<\/strong><\/td>\n<td>1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/details>\n<details class=\"hall-of-fame\">\n<summary><strong>HoF Members | 2021<\/strong><\/summary>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>\n<table style=\"height: 96px;\" border=\"1px\" width=\"841\">\n<tbody>\n<tr>\n<th style=\"color: white;\"><strong> Reporter <\/strong><\/th>\n<th style=\"color: white;\"><strong> # reports in 2021 <\/strong><\/th>\n<\/tr>\n<tr>\n<td><strong>HackerAhmed<\/strong><\/td>\n<td>1<\/td>\n<\/tr>\n<tr>\n<td><strong>Pritam Dash<\/strong><\/td>\n<td>2<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/details>\n","protected":false},"excerpt":{"rendered":"<p>We appreciate your interest in our program for responsible disclosure. We value the help of security researchers and individuals in spotting and reporting potential flaws since we take the security of our systems and user data seriously. This program provides instructions for the proper disclosure of any identified security flaws. Scope Any of the Rently&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":"","_links_to":"","_links_to_target":""},"class_list":["post-1213","page","type-page","status-publish","hentry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Responsible Disclosure | Rently<\/title>\n<meta name=\"description\" content=\"Rently&#039;s Responsible Disclosure program provides instructions on the proper reporting of any identified security flaws.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/use.rentlysales.com\/?page_id=1213\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Responsible Disclosure | Rently\" \/>\n<meta property=\"og:description\" content=\"Rently&#039;s Responsible Disclosure program provides instructions on the proper reporting of any identified security flaws.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/use.rentlysales.com\/?page_id=1213\" \/>\n<meta property=\"og:site_name\" content=\"Rently\" \/>\n<meta property=\"article:modified_time\" content=\"2024-09-17T20:28:45+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/use.rentlysales.com\\\/?page_id=1213\",\"url\":\"https:\\\/\\\/use.rentlysales.com\\\/?page_id=1213\",\"name\":\"Responsible Disclosure | Rently\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/use.rentlydev.com\\\/#website\"},\"datePublished\":\"2023-07-13T22:02:54+00:00\",\"dateModified\":\"2024-09-17T20:28:45+00:00\",\"description\":\"Rently's Responsible Disclosure program provides instructions on the proper reporting of any identified security flaws.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/use.rentlysales.com\\\/?page_id=1213#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/use.rentlysales.com\\\/?page_id=1213\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/use.rentlysales.com\\\/?page_id=1213#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/use.rentlysales.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Responsible Disclosure\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/use.rentlydev.com\\\/#website\",\"url\":\"https:\\\/\\\/use.rentlydev.com\\\/\",\"name\":\"Rently\",\"description\":\"Smart Leasing Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/use.rentlydev.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/use.rentlydev.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/use.rentlydev.com\\\/#organization\",\"name\":\"Rently\",\"url\":\"https:\\\/\\\/use.rentlydev.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/use.rentlydev.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/use.rently.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/Rently_Logo_Primary_Small.png\",\"contentUrl\":\"https:\\\/\\\/use.rently.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/Rently_Logo_Primary_Small.png\",\"width\":500,\"height\":186,\"caption\":\"Rently\"},\"image\":{\"@id\":\"https:\\\/\\\/use.rentlydev.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Responsible Disclosure | Rently","description":"Rently's Responsible Disclosure program provides instructions on the proper reporting of any identified security flaws.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/use.rentlysales.com\/?page_id=1213","og_locale":"en_US","og_type":"article","og_title":"Responsible Disclosure | Rently","og_description":"Rently's Responsible Disclosure program provides instructions on the proper reporting of any identified security flaws.","og_url":"https:\/\/use.rentlysales.com\/?page_id=1213","og_site_name":"Rently","article_modified_time":"2024-09-17T20:28:45+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/use.rentlysales.com\/?page_id=1213","url":"https:\/\/use.rentlysales.com\/?page_id=1213","name":"Responsible Disclosure | Rently","isPartOf":{"@id":"https:\/\/use.rentlydev.com\/#website"},"datePublished":"2023-07-13T22:02:54+00:00","dateModified":"2024-09-17T20:28:45+00:00","description":"Rently's Responsible Disclosure program provides instructions on the proper reporting of any identified security flaws.","breadcrumb":{"@id":"https:\/\/use.rentlysales.com\/?page_id=1213#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/use.rentlysales.com\/?page_id=1213"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/use.rentlysales.com\/?page_id=1213#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/use.rentlysales.com\/"},{"@type":"ListItem","position":2,"name":"Responsible Disclosure"}]},{"@type":"WebSite","@id":"https:\/\/use.rentlydev.com\/#website","url":"https:\/\/use.rentlydev.com\/","name":"Rently","description":"Smart Leasing Platform","publisher":{"@id":"https:\/\/use.rentlydev.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/use.rentlydev.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/use.rentlydev.com\/#organization","name":"Rently","url":"https:\/\/use.rentlydev.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/use.rentlydev.com\/#\/schema\/logo\/image\/","url":"https:\/\/use.rently.com\/wp-content\/uploads\/2023\/04\/Rently_Logo_Primary_Small.png","contentUrl":"https:\/\/use.rently.com\/wp-content\/uploads\/2023\/04\/Rently_Logo_Primary_Small.png","width":500,"height":186,"caption":"Rently"},"image":{"@id":"https:\/\/use.rentlydev.com\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/use.rentlydev.com\/index.php?rest_route=\/wp\/v2\/pages\/1213","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/use.rentlydev.com\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/use.rentlydev.com\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/use.rentlydev.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/use.rentlydev.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1213"}],"version-history":[{"count":0,"href":"https:\/\/use.rentlydev.com\/index.php?rest_route=\/wp\/v2\/pages\/1213\/revisions"}],"wp:attachment":[{"href":"https:\/\/use.rentlydev.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1213"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}