Simeji - Japanese Keyboard with Emoticons
Simeji - 日本語文字入力＆スタンプ・顔文字キーボード
調査方法のルール
Please only conduct test against the application specified here as target. Vulnerabilities reported on applications outside of the targets are not eligible for bounty rewards. Any vulnerability test against the domains outside of the targets are explicitly prohibited.
Any violation of the Terms of the Service of the “ZERO/ONE Bug Bounty Platform”, and/or performance of DoS （Denial of Service）attack or equivalent act that can degrade the performance of our service are also explicitly prohibited.
The vulnerability targets of this program is limited. Please note that reports of vulnerabilities not listed here are not eligible for bounty rewards. For more details, please refer to the “Bounty Payment Policy”
The following applications are the targets for this program.
対象は以下のアプリケーションになります。
Simeji
・iOS
https://itunes.apple.com/jp/app/id899997582?mt=8
・Android
https://play.google.com/store/apps/details?id=com.adamrocker.android.input.simeji
As for the Android, bounty rewards will be eligible from version 10.0.3.
Android版につきましては、Version 10.0.3以降が対象になります。
Simeji Pro (Limited to iOS)
https://itunes.apple.com/jp/app/id959791915?mt=8
※1 The server that the application connect are explicitly outside of the target.
※2 Desktop version of the Simeji for Windows（β）are outside of the targets.
※1 アプリケーションが接続するサーバは調査対象範囲外です。
※2 PC版のSimeji for Windows（β）は対象外になります。
報奨金の支払いポリシー
The following vulnerabilities are eligible form bounty rewards.
1. Hijack smartphone
Hijack: Ability to call or send SMS, email, activate camera, spy camera, or eavesdropping despite the intention of the user.
2. Unauthorized access (Ability to gain access to information without permission.)
: Information submitted when applying for Android / At the privacy setting on iOS
(Ability to gain device information despite what user have granted permission on the Settings>Privacy)
: Ability to gain access to information that user haven’t allowed to sent on Simeji.
3. Use of “Moplus SDK”
(1) Application contain the source code of “Moplus SDK”
(2) Ability to execute the function of the “Moplus SDK” (If the application are using the “Moplus SDK”)
The following outlines the bounty for specific classes of vulnerabilities listed as item 1. to 3. above.
¥100,000 〜 ¥300,000 per vulnerability
4. Report of vulnerabilities not listed above may be eligible for the bounty (¥10,000-)