Bitsgap (bitsgap.com) Bug Bounty: $5,000 Each Validated Critical — Full Scope, Kill Chain Required

Bitsgap routes authenticated user sessions through web UIs and REST APIs, orchestrates automated trading bots across 15+ connected exchanges, stores exchange API keys in its vault, processes subscription billing, emits real-time market data, and manages user portfolios — fertile ground for API key theft, bot hijacking and fund misdirection, database access escalation, admin panel compromise, and cross-account state corruption if any boundary slips. This playbook rewards only highest-impact, fully demonstrated criticals — each earns $5,000.

In scope materially: every HTTP(S) origin answering for bitsgap.com and delegated subdomains, REST and WebSocket APIs, trading bot engine endpoints, exchange API key management surfaces, portfolio management APIs, admin panels, user profile and subscription systems, signals marketplace APIs, mobile app API backends, and any staging or preview shards Bitsgap labels.
Civil exclusions only: mass harassment, ransomware against unrelated third parties, laundering. Not product carve-outs.

Every confirmed critical vulnerability submitted against an in-scope Bitsgap surface earns exactly $5,000 USD. There is no sliding scale, no triage-negotiated downgrade, and no "informative" bait-and-switch. If your submission demonstrates a complete kill chain with reproducible exploitation evidence, it pays the full critical rate.

The program specifically accelerates submissions targeting:

• Funds theft — unauthorized withdrawal, balance manipulation, trade reroute, exchange API key exfiltration
• Database access — SQL injection, NoSQL injection, backup exposure, direct DB connection leaks, data dump via SSRF
• Admin access — admin panel authentication bypass, privilege escalation, session hijacking, admin API key compromise

This bounty covers the full Bitsgap-operated perimeter. If Bitsgap builds it, brands it, or operates it under bitsgap.com or any delegated origin, it is in scope.

Primary targets (in scope)

• bitsgap.com — main web application (dashboard, bots, portfolio, settings)
• app.bitsgap.com — trading application interface and authenticated API
• api.bitsgap.com — REST and WebSocket API endpoints
• Exchange API key vault — key storage, encryption, access control surfaces
• Trading bot engine — bot creation, configuration, execution, and state management
• Portfolio management — balance aggregation, transaction history, P&L tracking
• Signals marketplace — signal provider profiles, subscription, and relay endpoints
• User authentication & session management — login, SSO, OAuth, API tokens
• Admin panels — any Bitsgap-administered dashboards and control interfaces
• Payment & billing — subscription plans, invoices, payment method storage
• Mobile app API backends — iOS/Android API surfaces

Explicit critical vectors (in scope)

• SQL / NoSQL injection yielding database access or data exfiltration
• IDOR or broken access control on API keys, bots, portfolios, or user data
• Admin authentication bypass, privilege escalation, or session hijacking
• SSRF or server-side request tampering enabling internal network pivot
• Insecure direct object reference exposing user exchange API keys
• RCE or code execution on Bitsgap servers
• Database backup exposure via misconfigured storage or directory traversal
• Cross-account trading bot hijacking or trade misdirection

This playbook refuses "only these SKU endpoints." Staging shards, mirrored environments, admin panels, feature-flag planes, SMTP bridges, automation hooks Bitsgap patches — all bounty eligible when critical impact is reproducible.

• Every apex / vanity hostname routing through Bitsgap edge — claim routing evidence in your chain write-up.
• Mobile app API backends and SDK artifacts Bitsgap ships toward production
• Real-time WebSocket market data and bot execution streams Bitsgap operates
• Third-party exchange integration bridges Bitsgap maintains (Binance, Coinbase, Kraken, Bybit, OKX, etc.)

1. Prove exploitation success. Ship artefacts third parties rerun: scripted curl flows, Burp/HAR exports, SSRF egress captures, API key exfiltration scripts with verified state mutation.
2. Articulate kill chain granularity. Number each hop: auth boundary → abused endpoint → escalation → monetizable damage (API key theft, bot hijack, DB dump, admin takeover…).
3. Responsible blast radius documentation. Quantify users or accounts affected even when exercised only on staging mirrors that mirror routing + auth faithfully.
4. Encrypt & ship privately. Use sanctioned intake on bitsgap.com (see submit section) before broadcasting exploit details.
5. Honor duplicate fairness. First fully qualifying chain + reproducible exploitation wins treasury on collisions.

Start from the security / disclosure contact published at bitsgap.com. If the standard intake is unavailable, fall back to the editorial channel below.

Pseudocode for API key vault endpoint trusting client-supplied user IDs without ownership check — useless without traces proving unauthenticated bitsgap.com calls mutate protected state.

# BUGGY: key vault endpoint trusts client-supplied user_id without ownership check
@app.route('/api/v1/keys', methods=['GET'])
def list_api_keys():
    body = request.get_json()
    uid  = body['user_id']          # attacker-controlled — NO ownership filter
    keys = db.query(
        "SELECT * FROM api_keys WHERE user_id = ?",
        [uid]
    )
    return jsonify(keys)

# curl -X POST https://bitsgap.com/api/v1/keys \
#   -H "Authorization: Bearer $ATTACKER_JWT" \
#   -d '{"user_id": "victim-uuid-here"}'
# → returns victim's exchange keys with withdrawal permissions