Who this Program applies to

This program applies to websites operated by:

• mrge Group GmbH, Neuer Wall 59, 20354 Hamburg, Germany
• digidip GmbH, Skalitzer Str. 68, 10997 Berlin, Germany
• shopping24 Gesellschaft für multimediale Anwendungen mbH, Neuer Wall 59, 20354 Hamburg, Germany
• Yieldkit GmbH, Neuer Wall 59, 20354 Hamburg, Germany
• mrge BC Advertising Inc., doing business as MaxBounty, PO Box 17039, Ottawa, Ontario, Canada K4A 4W8
• mrge Americas Inc., 1001 Boulevard de Maisonneuve West, Suite 1510, Montreal, Quebec, Canada H3A 3C8
• Sokno Media, Inc., doing business as SourceKnowledge, 1001 Boulevard de Maisonneuve West, Suite 1510, Montreal, Quebec, Canada H3A 3C8

These companies are referred to collectively as "mrge", "we", "us" or "our". These terms are used for readability only. They do not mean that the mrge group is one legal entity or that every company is responsible for every processing activity.

Introduction

mrge is committed to ensuring the security of our customers by protecting their information from unwarranted disclosure. This policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us.

This policy describes what systems and types of research are covered under this policy, how to send us vulnerability reports, and how long we ask security researchers to wait before publicly disclosing vulnerabilities.

We want security researchers to feel comfortable reporting vulnerabilities they've discovered - as set out in this policy - so we can fix them and keep our users safe. We have developed this policy to reflect our values and uphold our sense of responsibility to security researchers who share their expertise with us in good faith.

mrge is subject to Regulation (EU) 2024/2847, the Cyber Resilience Act. Our regulatory reporting and customer notification commitments under that Act are set out below, under "Regulatory Reporting Obligations."

Regulatory Reporting Obligations (EU Cyber Resilience Act)

mrge is subject to Regulation (EU) 2024/2847 (the Cyber Resilience Act, "CRA"). Where an actively exploited vulnerability is contained in an in-scope product, or a severe incident has an impact on the security of an in-scope product, mrge reports it through the ENISA Single Reporting Platform within the timelines required by Article 14 CRA.

After becoming aware of an actively exploited vulnerability or a severe incident having an impact on the security of an in-scope product, mrge informs impacted users and, where appropriate, all users, in accordance with Article 14(8), including available risk-mitigation or corrective measures. Security updates are accompanied by appropriate advisory information and remediation guidance. mrge may also publish a public advisory where appropriate; publication of a public internet advisory is not, by itself, the Article 14 reporting requirement.

Authorization

If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, we will work with you to understand and resolve the issue quickly, and mrge will not recommend or pursue legal action related to your research.

Guidelines

Under this policy, "research" means activities in which you:

• Notify us as soon as possible after you discover a real or potential security issue.
• Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
• Only use exploits to the extent necessary to confirm a vulnerability's presence. Do not use an exploit to compromise or exfiltrate data, establish command line access and/or persistence, or use the exploit to "pivot" to other systems.
• Provide us a reasonable amount of time to resolve the issue before you disclose it publicly.
• You do not intentionally compromise the privacy or safety of mrge personnel or any third parties.
• You do not intentionally compromise the intellectual property or other commercial or financial interests of any mrge personnel or entities, or any third parties.

Once you've established that a vulnerability exists or encountered any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), you must stop your test, notify us immediately, and not disclose this data to anyone else.

Scope

All systems, applications and services listed below are in scope. For listed domains, associated subdomains are also in scope unless explicitly excluded.

Vulnerabilities found in systems operated by our vendors fall outside this policy’s scope and should be reported directly to the relevant vendor under their disclosure policy, where available. If you are unsure whether a system, application or endpoint is in scope, contact compliance@mrge.com before starting your research.

If you believe a system, application or service not listed below merits testing, please contact us before doing so.

In-scope assets

mrge group domains listed below, including associated subdomains unless explicitly excluded

• digidip browser extension (Chrome)
• MaxBounty mobile application (iOS)
• MaxBounty mobile application (Android)
• SourceKnowledge Shopping Ads application (Shopify), limited to components operated by SourceKnowledge 

Domains within scope

https://mrge.com/

http://shopping24.de/

http://digidip.net/

http://yieldkit.com/

http://sourceknowledge.com/

http://maxbounty.com/

Rules of Engagement

Security researchers must not:

• Test any system other than the systems set forth in the 'Scope' section above,
• disclose vulnerability information except as set forth in the 'Reporting a Vulnerability' and 'Disclosure' sections below,
• engage in physical testing of facilities or resources,
• engage in social engineering,
• send unsolicited electronic mail to mrge users, including "phishing" messages,
• execute or attempt to execute "Denial of Service" or "Resource Exhaustion" attacks,
• introduce malicious software,
• test in a manner which could degrade the operation of mrge systems; or intentionally impair, disrupt, or disable mrge systems,
• test third-party applications, websites, or services that integrate with or link to or from mrge systems,
• delete, alter, share, retain, or destroy mrge data, or render mrge data inaccessible, or,
• use an exploit to exfiltrate data, establish command line access, establish a persistent presence on mrge systems, or "pivot" to other mrge systems.

Security researchers may:

• View or store mrge nonpublic data only to the extent necessary to document the presence of a potential vulnerability.

Security researchers must:

• cease testing and notify us immediately upon discovery of a vulnerability,
• cease testing and notify us immediately upon discovery of an exposure of nonpublic data, and,
• purge any stored mrge nonpublic data upon reporting a vulnerability.

Reporting a Vulnerability

We accept vulnerability reports to compliance@mrge.com. PGP encryption is available on request, contact us first and we will provide a public key for encrypting your report. Reports submitted directly to mrge cannot be submitted anonymously. Researchers who wish to report anonymously may use the applicable coordinated vulnerability disclosure channel of the relevant CSIRT. We will not share names or contact data of security researchers unless given explicit permission.

Information submitted under this policy will be used for defensive purposes only - to mitigate or remediate vulnerabilities. If your findings include newly discovered vulnerabilities that affect all users of a product or service and not solely mrge, we may share vulnerability reports with the regulatory bodies, as well as any affected vendors. We will not share names or contact data of security researchers unless given explicit permission.

By sending a report to compliance@mrge.com you are indicating that you have read, understand, and agree to the guidelines described in this policy for the conduct of security research and disclosure of vulnerabilities or indicators of vulnerabilities related to mrge information systems, and consent to having the contents of the communication and follow-up communications stored by mrge for continuous improvement and learning.

In order to help us triage and prioritize submissions, we recommend that your reports:

• Describe the vulnerability, where it was discovered, and the potential impact of exploitation.
• Offer a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts, CVSS score and screenshots, if applicable, are helpful).
• Adhere to all legal terms and conditions outlined within this policy.
  

Coordinated Disclosure Policy

mrge is committed to timely correction of vulnerabilities. However, we recognize that public disclosure of a vulnerability in the absence of a readily available corrective action likely increases rather than decreases risk. Accordingly, we require that you refrain from publicly disclosing information about discovered vulnerabilities until coordinated disclosure has taken place.

mrge follows a coordinated vulnerability disclosure in which a vulnerability or an issue is disclosed to the public only after the responsible parties, in coordination with possible external parties, have been allowed sufficient time to patch or remedy the vulnerability or issue.

If you believe others should be informed of the vulnerability prior to our implementation of corrective actions, we require that you coordinate in advance with us.

mrge's public advisory and customer notification commitments under the Cyber Resilience Act are set out under "Regulatory Reporting Obligations" above.

Rewards and Acknowledgments

For a vulnerability to qualify for acknowledgement or reward, it must fulfill all of the following requirements:

• Unknown: if a reported vulnerability is already known and either being addressed or the risk it poses accepted, the vulnerability does not qualify.
• Documented: the researcher has to provide sufficient documentation to enable the vulnerability to be comprehended without in-depth research and reproduced. If this is not provided, the vulnerability does not qualify.
• Reproducible: the vulnerability has to be reproduced by us. If this is not possible, the vulnerability does not qualify.

The reward amount, if any, is determined at mrge's discretion based on the overall assessment of the report. Relevant factors may include, but are not limited to:

• the severity and potential business impact of the vulnerability;
• the quality, clarity and completeness of the documentation provided;
• the reproducibility of the finding;
• the novelty of the vulnerability;
• the effort required to identify and validate the finding;
• whether the report enabled mrge to resolve the issue effectively.

A vulnerability must meet the qualification criteria defined in this program in order to be eligible for a reward. Submission of a report does not automatically create an entitlement to payment.

The final decision regarding whether a reward is granted and the amount of such reward remains at the discretion of mrge.

mrge may choose to publish acknowledgments on our homepage or social media channels. We will not do so without the prior explicit permission of the security researcher.

Questions

Questions regarding this Program may be sent to compliance@mrge.com. We also invite you to contact us with suggestions for improving this policy.