We work hard to keep Swiggy secure, and make every effort to keep on top of the latest threats by working with our inhouse security team. If you think we've made a security mistake or have a vulnerability, please share with us right away

If you're the first one to alert us and it leads to us making a change, we'll pay you a reward based on the criticality.

To participate in the Swiggy Bug Bounty Program, you can Sign Up using your phone number and email ID from the website home page or app. Do ensure that you are reachable on the mobile number that you shall use to register with us. While creating account, participants should use this particular email ID format as below: username@domain.com

Participants to the Program shall strictly be bound by Swiggy Non-Disclosure Terms.

Bug Bounty: <Vulnerability Category> - <Bounty Hunter Full Name>

Vulnerability Information:

Name of Vulnerability:

Vulnerability Category:

Description:

Vulnerable Instances:

Steps to Reproduce:

Proof of Concept:

Impact:

Recommendation:

Full Name:

Email Address:

Mobile Number:

Any Publicly Identifiable profile:

Vendor Endpoints

Delivery App Endpoints

3rd Party Applications

All the bounty rewards will be paid based on an internal assessment by the Swiggy security team. We have grouped vulnerabilities based on impact in below severity categorisation. Vulnerability categorisation based on severity created to give insight how we assess the vulnerabilities. It's not an exhaustive list and Swiggy can update it at any point of time.

SQL Injections (Able to access and manipulate sensitive and PII information)

Remote Code Execution (RCE) vulnerabilities

Vertical privilege escalation (Gaining admin access)

Bulk user sensitive information leak

Business logic vulnerabilities (Critically impacting Swiggy Brand, User (Customer/Vendor/Delivery Executive) data and financial transactions)

Authentication bypasss

Non-Blind SSRFs

Account Takeover (Without user interaction)s

Stored XSSs

Subdomain Takeover (On active domains )s

IDOR (Able to access and modify sensitive and PII information)s

Horizontal privilege escalations

Deserialization vulnerabilitiess

Path traversal (Access to sensitive information)s

Mobile App vulnerability (Doesn’t require root/jailbreak access on the device and having access to sensitive information)s

SQL Injection (For non-sensitive information)

Account Takeover (With user interaction)

IDOR ( (Able to access and modify non-sensitive information)

Reflected/DOM XSS to steal user cookies

Subdomain Takeover ( On non-active domains)

Injection attacks ( Formula injection, Host header injection)

Mobile App vulnerability (Require root/jailbreak access on the device and having access to sensitive information)

Path Traversal (Access non-sensitive information)

IDOR (Non-sensitive information disclosure)

Mobile App vulnerability (Require root/jailbreak access on the device and having access to non-sensitive information)

Mobile App vulnerability (Doesn’t require root/jailbreak access on the device and having access to non-sensitive information)

Captcha bypass

IDOR references for objects that you have permission to

Duplicate submissions that are being remediated

Known issues

Rate limiting (Unless which impacts severe threat to data, business loss)

Multiple reports for the same vulnerability type with minor differences (only one will be rewarded)

Open redirects

Clickjacking and issues only exploitable through clickjacking

Only session cookies needed http and secure flags. Apart from these, for other cookies we won’t consider as vulnerability

Social Engineering attacks

Patches released within the last 30 days

Networking issues or industry standards

Password complexity

SPF or DMARC records

Gmail "+" and "." acceptance

Email bombs

Unsubscribing from marketing emails

Descriptive error messages (e.g. Stack Traces, application or server errors)

HTTP 404 codes/pages or other HTTP non-200 codes/pages

Fingerprinting / banner disclosure on common/public services

Disclosure of known public files or directories, (e.g. robots.txt)

Cacheable SSL pages

SSL/TLS best practices

CSRF on forms that are available to anonymous users (e.g. the contact form, sign-up form)

Logout Cross-Site Request Forgery (logout CSRF)

Weak CSRF in the APIs

Forgot Password page brute force and account lockout not enforced

Lack of Captcha

Sessions not expiring after email change

Presence of application or web browser 'autocomplete' or 'save password' functionality

Session Timeouts

All information which a reasonable person would consider confidential under the context of disclosure or due to the nature of the information itself, and shall include technical and non-technical information, intellectual property rights, know-how, designs, techniques, plans, procedure, improvement, technology or method, object code, source code, databases or any other information relating to the Company’s product, work in progress, future development of the Company’s product

Marketing strategies, plans, financial information, projections, operations, sales estimates, shareholding patterns, business plans and performance results relating to the past, present or future business of the Company, plans for products or services, and customer or supplier lists

The content, the technical documents and all information in relation to the Company’s product the terms of this Agreement

Any information which may be communicated.

The Participant undertakes to treat and maintain all Confidential Information in confidence. With respect thereto, the Participant undertakes and agrees as follows:

These Terms do not create a joint venture or partnership between the Parties.

For a period of 5 (five) years the Participant shall not publish, disseminate, disclose any Confidential Information.

The Participant shall use the Confidential Information only in connection with the Purpose and for no other reason whatsoever

The Participant shall not copy or reproduce to writing any part of the Confidential Information and any copies, reproductions or reductions to writing of the Confidential Information which have already been made by the Parties shall be the property of the Company.

The Participant shall not, from the date of agreeing to these Terms, independently develop or have developed for itself products, concepts, systems or techniques that are similar to or compete with the products, concepts, systems or techniques contemplated by or embodied in the Confidential Information of the Company or the Purpose, which development shall be construed as a violation of the obligations of the Participant under these Terms.

The Participant shall indemnify, defend and hold the Company harmless from and against any losses, costs, expenses, damages of whatsoever nature which may be incurred or suffered by the Company arising out of or as a result of any breach of contract, warranty, tort (including negligence) or otherwise of any of the Participant’s obligations or agreements contained herein.

All Confidential Information furnished to the Participant by the Company shall remain the exclusive property of the Company and the Company shall have the sole and exclusive ownership of all right, title, and interest in and to the Confidential Information, including ownership of all copyrights, patents and trade secrets pertaining thereto, subject only to the rights and privileges expressly granted by the Company under the Terms mentioned here in above.

Promptly upon the Company’s request at any time, the Participant shall return / cause to be returned to the Company all the Confidential Information, including all materials or documents, any copies, summaries and notes of the contents thereof (whether in hard or soft copy form) without limitation, all copies of any analyses, compilations, studies or other documents prepared by and/or for Company, containing or reflecting any Confidential Information and give written certification accordingly.

The Participant understands and acknowledges that any disclosure or misappropriation of any of the Confidential Information in violation of the confidentiality obligations will cause the Company grave and irreparable harm, loss and injury, the amount of which may be difficult to ascertain. The Participant agrees that the Company have the right to apply to a court of competent jurisdiction for specific performance and/ or an order restraining and enjoining any such further disclosure or breach and for such other relief as the Company shall deem appropriate, without posting or the need to post any bond or other security. Such right of the Company to obtain equitable relief in the form of specific performance, temporary restraining order, temporary or permanent injunction or any other equitable remedy which may then be available to it, without the necessity of proving actual damages, shall be in addition to the remedies otherwise available to it at law. The Participant expressly waives the defense that a remedy in damages will be adequate.

Nothing contained in the Terms mentioned hereinabove shall be construed to obligate the Company to disclose any information to the Participant.

Any notice or communication to be given under to the Participant shall be given if delivered in writing to the intended Participant on the email id provided by the Participant at the time of registration

These Terms shall be fully binding upon the Participant.

The Participant shall not make any assignment of these Terms or any interest therein.

The failure of the Company to insist upon or enforce strict performance of any of the Terms mentioned hereinabove or to exercise any rights or remedies mentioned hereinabove, shall not be construed as a waiver or relinquishment to any extent of the Company’s rights to assert or rely upon any such provisions, rights or remedies in that or any other instance; rather the same shall remain in full force and effect.

These Terms shall be governed by, construed and enforced in accordance with the laws of the Republic of India.

The courts in Bangalore shall have the exclusive jurisdiction