Bug Bounty Program

The eSimka team accepts reports about vulnerabilities that may affect the security of users, data, payments or service infrastructure.

Independent researchers, research teams and organizations may participate if they follow the law and the rules of this program.

The reward goes to the first researcher who reports a previously unknown valid vulnerability and sends enough data to reproduce it.

You may test only these eSimka assets:

If a domain, app or service is not listed, do not test it without written approval from the eSimka team.

We do not accept the following tests or reports under this program:

Test only your own accounts, orders, devices and eSIM profiles. Do not try to access other users’ data.

If you accidentally see another user’s data, stop testing, do not save the data and email us.

Do not modify, delete or damage data, settings, orders, balances, eSIM profiles or service infrastructure.

Do not take actions that may degrade the website, payments, support, the Telegram bot or mobile applications.

For automated testing, stay below 10 requests per second and stop the test if the service returns errors or slows down.

Use the smallest proof of concept that confirms the issue. For RCE, SQLi, SSRF, LFI/SSTI and similar vulnerabilities, confirm the problem safely without extracting secrets or harming the system.

Publish vulnerability details only after the eSimka team fixes the issue and approves disclosure. The baseline coordinated disclosure period is 90 days.

The eSimka team evaluates each report using CVSS, possible damage, attack complexity and impact on users, data, payments and infrastructure. The final severity level may be raised or lowered after review.

The exact amount depends on the case, researcher contribution, report quality and completeness of the proof of concept.

Less serious issues without substantial security impact may receive a reward at the team’s discretion.

We do not pay for duplicate reports. Priority goes to the first complete report with enough data for the team to reproduce the issue.

Include the details the team needs to verify the vulnerability:

Do not include other users’ personal data, secrets, tokens, private keys or full data dumps. If such data appears in a proof of concept by accident, reduce it and call it out in the report.

We acknowledge receipt of a report within 3 business days.

We review the report and share the result within 14 business days. For complex cases, the team may request more details.

After we confirm a vulnerability, we tell the researcher the fix status and expected timeline. The team pays the reward after fixing the issue or reducing the risk, unless both sides agree otherwise.

We may reject a report if the team cannot reproduce the issue, sees no practical impact, received the same report earlier or finds that the test was outside the program scope.

If a fix requires more than 90 days, the team agrees on a new disclosure timeline with the researcher.

If a researcher follows the program rules, stays within approved assets, does not extract other users’ data and does not degrade the service, eSimka will not initiate a report or claim over that testing.

This notice does not cover actions that violate the program rules, the law, third-party rights, user confidentiality or service availability.

The researcher must not demand payment through threats, disclose vulnerability details before the agreed timeline or use the issue outside the test.

Send vulnerability reports to security@esimka.ru with the subject “Vulnerability report”. This address is used for both esimka.ru and esimka.io.

The machine-readable security contact is published at /.well-known/security.txt.

For regular support, orders and refunds, use sup@esimka.ru or the Telegram bot @esimka. Do not send vulnerability reports to the general support channel.