1. What are the rewards?
TAP does not offer financial compensation for reporting vulnerabilities.
TAP appreciates responsible disclosure of vulnerabilities. This policy describes the rules governing this process and how you can submit a vulnerability report to us. Please note that TAP may alter this policy from time to time.
If you are a cybersecurity analyst willing to contribute to the discovery of security vulnerabilities in our applications, you must first read this policy and follow the rules described here.
2. What can be included in the scope of cybersecurity testing?
- Any subdomain of the following domains:
- *.flytap.com
- *.tapforbiz.com
- *.tapcargo.com
- *.tapairportugal.com
- *.tap.pt
- *.tapme.pt
- *.portugalia-airlines.pt
- *.ucs.pt
- Any TAP Air Portugal mobile application available in iOS and Android official stores.
3. What is outside the scope of cybersecurity testing?
Any domain, subdomain, or mobile application not specifically included in the scope.
4. What tests are prohibited?
- Automated scans.
- Performance or stress testing and disruptive testing, including denial of service (DoS or DDoS) testing.
- Attacks on TAP employees or users, including social engineering, extortion, spamming or phishing.
- Any physical security tests.
- Introduction of backdoors or any persistent access.
- Introduction of changes to systems or applications.
- The modification or deletion of data in systems or applications.
5. What vulnerabilities are not eligible?
- Automated scan results.
- Good security practices, such as security headers and cookie flags.
- Insecure SSL/TLS versions or ciphers.
- Settings related to SPF, DKIM and DMARC.
- Vulnerabilities with minimal impact.
- A vulnerability already communicated or detected by TAP’s own resources.
6. What are the relationship rules?
- Act in good faith and comply with applicable legislation.
- Do not violate the privacy, integrity or availability of data.
- Do not extract data.
- Immediately and exclusively report any vulnerability discovered to TAP.
- Perform testing activities only to the extent necessary to confirm the vulnerability. Stop as soon as its existence is proven.
- If you are not sure that the testing activities will not cause damage to TAP, stop the tests and contact us.
- Provide sufficient details for TAP to be able to reproduce the vulnerability.
- Please give us a reasonable amount of time to analyze, reproduce, and fix the vulnerability.
- Send us the report in english or portuguese.
7. How to submit a report?
To submit a report, click here.
8. What is TAP’s commitment?
- It’s not guaranteed that you will receive any response from TAP related to your report.
- You will only be contacted regarding your report if TAP deems it necessary.
9. What about your privacy?
TAP will only use your personal data to contact you as part of your vulnerability report.
However, following the need-to-know principle, we may provide your personal data to our business partners, but always in compliance with current personal data protection legislation.
After the process is complete, we will keep your personal data for a maximum period of one year.