Prozorro

Prozorro is a public electronic procurement system where state and municipal customers announce tenders to purchase goods, works and services, and business representatives compete for the opportunity to become a state supplier.

Старт: 01.01.2021 Оновлено: 01.01.2021
Статус Open
Сфера тестування Web, API
Всього звітів
Валідовані звіти

Program Scope (EN)

Prozorro Bug Bounty is a safe space for ethical (“white hat”) hackers. You can legally explore our systems, help uncover vulnerabilities, and receive rewards. We provide a dedicated staging environment; all research is performed strictly within the legal framework and the Program rules.

In focus: web portals and related APIs. Any intervention in production is strictly prohibited.

Our story
  • 2019 — we held one of Ukraine’s first offline bug bounty marathons (news (UA)).
  • 2020 — launched a continuous online program.
  • 2022 — suspended the online program due to the full-scale invasion.
  • 2023 — resumed vulnerability research on staging.
Participants are granted access to copies of: the central DB, the official portal, AMCU and SASU offices, and the connected platforms. We guarantee legal safety provided the rules are followed and research is limited to scope.
Researcher Leaderboard
# Username Critical High Medium Low Info Points
1Jarvis ( Twitter )98151931906
2Saraychikov Sergey531220974
3Spachynskyi Vasyl (stopvvar)52500725
4Сhinskiy31890658
5SoloAdmiral32730611
60xj3st3r02820299
7KOMPOT11280296
8w2w12000200
9Taras11100175
10kazan71p ( Twitter )10200175
11sh.root01130111
12Яноші Михайло10000100
13Raju Basak0031092
14CactusDiego0100050
15dante0010025
16Abdalla Waseem0010025
17Gaurav0001012

As of 16.04.2025 (since 17.09.2020: P4 vulnerabilities are not rewarded but earn points; P5 are not accepted and not rewarded).

Rewards
Category Examples of vulnerabilities* Reward, UAH** Points Points (duplicate)
Critical (P1) File Inclusion, RCE, SQL Injection, XXE, Authentication Bypass, Sensitive Data Exposure, Command Injection, Hardcoded Password… 28 000 100 25
High (P2) XSS (P2 specific), SSRF, CSRF (application-wide), App-level DoS (not DDoS), Weak Password Reset… 14 000 50 12
Medium (P3) HTTP Response Manipulation, Content Spoofing, Session Fixation, XSS/SSRF (P3 specific)… 8 400 25 5
Low (P4) Non-sensitive info disclosure, Open Redirect, Debug Info, HTML Injection in own email… 0 12 2
Info (P5) Self-XSS, Insecure Transport, Missing security headers, Spam, Reflected File Download (RFD)… 0 0 0

* Categories follow the Bugcrowd VRT and may change depending on real-world impact (details).
** Payments are made subject to taxes and fees under Ukrainian law (details in the offer agreement).

Reporting procedure

We recommend using this report template. Please include:

  • Domain/resource where the vulnerability was found;
  • PoC exploit(s), if available;
  • HTTP requests demonstrating the issue;
  • Screenshots of the reproduction steps;
  • Your severity assessment and rationale;
  • Video demonstration (if possible).

Send reports to disclosure@prozorro.ua with subject: “ProzorroBB: Bug Name”. One report = one vulnerability.

In Scope

Research applies only to the domains and IPs listed below in the staging environment.

Prozorro Platform
HostIPAdditional Info
staging.prozorro.gov.ua195.178.150.103
auction-staging.prozorro.gov.ua195.178.157.50, 195.178.157.60
audit-api-staging.prozorro.gov.ua195.178.157.50, 195.178.157.60
public-api-staging.prozorro.gov.ua195.178.157.50, 195.178.157.60
public-docs-staging.prozorro.gov.ua195.178.157.50, 195.178.157.60
swift-staging.prozorro.gov.ua195.178.157.50, 195.178.157.60
sas-staging.prozorro.gov.ua195.178.150.103key and password: 123456 “Test CSC of JSC “IIT”
amcu-staging.prozorro.gov.ua195.178.150.103key and password: 123456 “Test CSC of JSC “IIT”
infobox.prozorro.org195.178.150.108, 195.178.150.106
risks-staging.prozorro.gov.ua195.178.150.82, 195.178.150.81
exam-staging.prozorro.gov.ua195.178.150.105key and password: 123456 “Test CSC of JSC “IIT”
exam-back-staging.prozorro.gov.ua195.178.150.105
Platform: Zakupivli.Pro
HostIPAdditional Info
zakupivli.today193.200.64.61
my.zakupivli.today193.200.64.61
Platform: Smart Tender
HostIPAdditional Info
test.smarttender.biz
api-test.smarttender.biz
content-test.smarttender.biz
smartid-test.smarttender.biz		 91.200.74.11
Platform: E-tender
HostIPAdditional Info
stage.e-tender.ua94.131.241.154
Platform: Ukrainian Universal Exchange suspended
HostIPAdditional Info
bbt.uub.com.ua77.123.141.132
Testing is prohibited

All resources not listed in “In Scope” are out of scope. Any interference with production systems is subject to Article 361 of the Criminal Code of Ukraine.

HostAdditional Info
*.prozorro.gov.ua
*.prozorro.org
*.prozorro.ua
*.openprocurement.org
*.s3.zakupivli.today
*.e-tender.ua
*gov.e-tender.ua
*auction.e-tender.ua
*biz.e-tender.ua
*smarttender.biz
*api.smarttender.biz
*content.smarttender.biz
*smartid.smarttender.biz
*uub.com.ua
Documentation on the Prozorro Platform
API Docs
Module: Public API

A public API for access to open data by unauthenticated users.

Module: Public DS

Access to files attached to procurement entities. Controls access and reads from storage. Example.

Module: Swift

OpenStack Swift-based storage. Accessed via the Document Service with temporary links. Example.

Module: Auction

Service for auction participants and observers.

Module: AMCU Cabinet

Office of the Antimonopoly Committee of Ukraine for reviewing complaints.

Module: SASU Cabinet

Office of the State Audit Service of Ukraine.

Module: Risk Indicators

Automated detection of suspicious procurements and transfer to SASU for monitoring.

Module: Audit API

API for accessing risk indicator data.

Terms, rights, and obligations
The Participant undertakes to:
  • Not disclose vulnerability details without the Organizer’s consent;
  • Refrain from illegal actions and sending spam;
  • Not share inappropriate content;
  • Not engage in harmful activities (e.g., malware distribution);
  • Not infringe others’ rights or privacy;
  • Not conduct DDoS attacks;
  • Comply with applicable laws and the Offer Agreement.
The Participant has the right to:
  • Receive remuneration in the prescribed manner;
  • Rely on legal protection, provided the Program rules are followed;
  • Receive responses and actions on submitted reports;
  • Other rights as defined in the Offer Agreement.
Questions & contacts

Email bugbounty@prozorro.ua — we’ll reply and/or get in touch via a convenient channel.

Legal documents
  • Offer agreement — link
Навігація