Update

Bug Bounty Program Barantum

Help us keep Barantum's CRM, Omnichannel Chat, and Call Center platform secure. Report valid vulnerabilities and earn rewards based on their severity.

Barantum Security Team · Last Updated: May 23, 2026

Announcement (Update)

Bug Bounty Temporary Suspension (Update)

Period: Starting May 23, 2026 – Until further notice

Thank you for the enthusiasm and participation of fellow bug hunters in helping keep Barantum secure.

Following up on our previous announcement, we would like to inform you that bug bounty submissions are once again temporarily suspended starting May 23, 2026 until further notice.

This suspension is due to the high volume of incoming reports, the large number of duplicate submissions, as well as the ongoing validation and remediation process.

Status:
  • New reports are temporarily not accepted.
  • Reports submitted before May 23, 2026 will still be processed gradually.

We also apologize if the review and report response process takes longer than usual (currently estimated at 4–8 weeks).

Thank you for your understanding and support.

Bug bounty temporary suspension announcement megaphone illustration
Previous Announcement

Bug Bounty Temporary Suspension

Period: April 1 – April 30, 2026

We are suspending acceptance of new reports to focus on:

  • Processing of accumulated duplicate reports.
  • Finalize the fixes to the production system.
Status New reports not accepted. Reopened May 1, 2026 (Sandbox required).

Thank you for your contribution in keeping Barantum safe.

About the Program

Barantum is Indonesia's leading CRM, Omnichannel Chat, and Cloud Call Center platform, helping businesses improve sales productivity and customer service performance. Since 2017, Barantum has provided cloud-based solutions to manage customer data, conversations, and team activities in one integrated system.

Barantum is committed to maintaining the security of our systems and customer data. We collaborate with the global security community to identify and resolve vulnerabilities that could potentially impact our platform. Your participation is vital in helping us enhance security and reliability.

Program Rules

  1. Submit vulnerability reports to bughunter@barantum.com. Reports must include:
    • A detailed description of the vulnerability
    • Clear and reproducible steps to replicate the issue
    • An evaluation of the potential impact
    • Written in English or Indonesian
  2. Submit only one vulnerability per report unless multiple issues need to be chained to demonstrate impact.
  3. Reports must contain valid and previously unreported vulnerabilities.
    • The first valid reporter is the only party eligible for a reward.
  4. Personal information may be required for bounty payment processing.
  5. Barantum employees and contractors are not eligible to participate.

Acknowledgements & Rewards

Rewards follow the CVSS 3.1 severity scoring guidelines:

Critical CVSS 9.0 – 10.0 Rp 5,000,000
High CVSS 7.0 – 8.9 Rp 3,000,000
Medium CVSS 4.0 – 6.9 Rp 1,000,000
Low CVSS 0.1 – 3.9 Rp 500,000

Required information for reward processing

  • Indonesian Citizen · KTP, NPWP, email, and bank account number
  • Foreign Nationals · Passport, email, and bank account number

Scope

The Barantum Bug Bounty Program covers the following assets:

Web Applications

www.barantum.com my.barantum.com

Mobile Applications

Barantum CRM Android Barantum CRM iOS

Please ensure your findings fall within the scope and have real impact to be eligible for rewards, especially for cross-tenant cases (many self-tenant reports do not qualify as our system is designed to be multi-tenant).

Out-of-scope findings will be considered on a case-by-case basis if deemed critical.

Exclusions

Out-of-Scope Assets

Any asset not listed in the scope section is considered out of scope.

Website / API Exclusions

  • Third-party service vulnerabilities
  • Clickjacking without sensitive actions
  • CSRF without significant impact
  • DoS and service disruption attacks
  • Bruteforce attacks on non-authentication endpoints
  • Issues on outdated browsers (older than 2 stable versions)
  • Banner disclosure and verbose error messages
  • Open redirects without security impact
  • Self-XSS / API injection without impact to other users (non-cross tenant)
  • Publicly accessible files (robots.txt, etc.)
  • Automated scanner results without valid proof of concept
  • Missing best practices (CSP, cookie flags, HTTP headers)
  • Infrastructure issues (TLS, open ports, SPF/DMARC)
  • Privilege escalation within the same tenant where the reporter controls multiple roles
  • Cross-tenant access requiring tenant identifiers without a realistic method to obtain them from another existing tenant

Mobile App Exclusions

  • Leaked URIs accessible by other apps
  • Missing exploit mitigations (PIE, ARC)
  • Lack of certificate pinning
  • Sensitive data in requests protected by TLS
  • File paths exposed in binaries
  • Runtime attacks requiring rooted/jailbroken devices
  • App crashes without sensitive data leakage
  • Third-party API keys without impactful exposure

Data Protection

By participating in this program, you acknowledge and agree to the following data handling obligations:

Definitions

  • Agreed Purposes — data processing related to the Bug Bounty Program
  • Confidential Information — non-public Barantum information
  • Data — all information processed during the program
  • Personal Data — information identifying an individual
  • Protection Failure — any data breach or unauthorized access

Researcher Obligations

  • Maintain confidentiality of all accessed data
  • Do not use data for personal or external purposes
  • Do not disclose any data without written permission
  • Report any suspected breach within 24 hours
  • Delete all data after investigation or upon request
  • Do not falsify or misuse Barantum data

Contact Information

For any questions regarding the Bug Bounty Program, contact our security team.

bughunter@barantum.com