Security · Bug bounty

Find a bug. Get rewarded.

We reward security researchers who help us keep our customers’ messages, contacts and accounts safe. Report valid vulnerabilities in Beep Africa’s platform privately and earn up to KSh 50,000.

Rewards

What we pay

Rewards depend on severity and impact, assessed with CVSS and how far the issue could affect our customers. The final amount is at our discretion, and one reward is paid per root cause, even if it affects several pages or endpoints.

CriticalUp to KSh 50,000Remote code execution, full account takeover, access to other customers’ messages or contacts, sending SMS on another customer’s balance, SMPP or API authentication bypass

HighUp to KSh 20,000SQL injection, stored XSS in the dashboard, IDOR exposing other accounts’ data, privilege escalation between sub-users, bypassing IP restrictions

MediumUp to KSh 7,500CSRF on sensitive actions, reflected XSS, information disclosure with real impact, business-logic flaws such as free credit or sender ID bypass

LowHall of fame + KSh 1,000 SMS creditIssues with limited impact that we still choose to fix

In scope

What you can test

www.beepafrica.com and beepafrica.com
sms.beepafrica.com: SMS & WhatsApp dashboard
The REST API at sms.beepafrica.com/SMSApi/
billing.beepafrica.com: billing portal
workspace.beepafrica.com: Business Workspace
hr.beepafrica.com: HR & Payroll
Our SMPP service (by arrangement: ask us for a test bind first)

Out of scope

What doesn’t qualify

Third-party services we use or link to, including mobile network operators, WhatsApp/Meta, payment providers and hosting providers
Denial-of-service, load testing, or anything that degrades service
Social engineering, phishing or physical attacks
Spam or sending messages to numbers you don’t own
Missing security headers, SPF/DMARC settings, clickjacking on pages with no sensitive actions, or self-XSS
Reports from automated scanners without a working proof of concept
Issues already reported by someone else, or already known to us

How it works

From report to reward

1Report

Email the details and a proof of concept to [email protected].

2Triage

We acknowledge within 3 business days and confirm severity.

3Fix

We fix the issue and keep you updated along the way.

4Reward

We pay the reward by M-Pesa or bank transfer once the fix is live.

🏆Hall of fameWith your permission, researchers who report valid issues are thanked here once the fix is live. Be the first!

Programme rules

Test responsibly, and get paid

To qualify for a reward you must be the first to report the issue, and your report must be clear enough for us to reproduce. Beep Africa employees, contractors and their families aren’t eligible. Rewards are paid in Kenya shillings and recipients are responsible for any tax due.

Follow our Responsible Disclosure Policy, whose safe harbour applies to this programme
Use only test accounts you create. Ask us for free test credit; don’t spend real customer credit
Send test messages only to phone numbers you own, and no more than 20 messages a day
Stop as soon as you reach other people’s data, and report it straight away. Don’t download, keep or share it
Keep the issue confidential until we confirm it’s fixed and agree to disclosure

Talk to a human

Found something?

Email [email protected] with the details. For anything else, our support team is here 24/7.