Keeping FirstClubsafe, together

At FirstClub, we take the security of our systems and our members' data very seriously. We value the work of security researchers in keeping our members safe. If you believe you have found a security vulnerability on FirstClub, we encourage you to report it to us responsibly, and we will work with you to resolve it.

How to report

Send your report by email, and please do not disclose any details of the vulnerability publicly until we have resolved it and closed your report.

security@firstclub.co.in

Please include

  • The affected URL, API endpoint, or app screen and version
  • The type of vulnerability and its impact
  • Clear steps to reproduce the issue
  • A proof of concept (screenshots, video, or request/response logs)

Program rules

What's expected of you

  • Do not use a vulnerability to cause damage to FirstClub, our systems, or our members.
  • Test only with accounts you own. Do not access, modify, or delete other members' data.
  • Do not run password spraying or credential stuffing against real member accounts.
  • Do not use automated scanners or tools that generate heavy traffic and could affect production systems.
  • Do not use malware, phishing, vishing, smishing, or any other social engineering against our employees or members.
  • Do not attempt to gain physical access to FirstClub offices, warehouses, or stores.
  • Do not place real orders, abuse offers or coupons, or trigger refunds as part of testing.
  • Third-party services and partners are out of scope unless explicitly listed.
  • Vulnerabilities in recently disclosed third-party software have a 30-day blackout period to allow time for patching.
  • All communication about a report must happen over email with security@firstclub.co.in. Contacting customer support or employees about a submission may lead to disqualification.

Out of scope

What we won't action

  • Username, email, or phone number enumeration via signup, login, or account recovery
  • Rate-limiting issues
  • SPF, DMARC, or DKIM issues without verifiable proof of spoofing
  • Best-practice issues such as missing security headers, HSTS, cookie flags, or TLS configuration
  • Reports from automated tools or scanners without a working proof of concept
  • Issues that affect only outdated app versions or browsers
  • Denial of service (DoS / DDoS) attacks
  • Attacks requiring a man-in-the-middle position or physical access to a device
  • Clickjacking on pages with no sensitive actions
  • Unauthenticated, login, or logout CSRF
  • Known vulnerable libraries without a working proof of concept
  • Content spoofing or text injection without a demonstrated attack vector
  • Open redirects, unless chained to show additional security impact
  • Stack traces, directory listings, and path disclosure
  • Self-XSS
  • Social engineering of members or employees
  • Low or medium severity CVEs in outdated software
  • Leaked credentials or documents, at FirstClub's discretion
  • Publicly accessible cloud storage buckets, unless they contain member data

Rewards

Thorough reports are recognized

Valid reports may be eligible for a reward. Rewards are decided by the FirstClub security team based on the security impact of the issue, and a bonus may be given for particularly thorough or high-quality reports. Researchers who report valid issues may also be listed in our acknowledgements below.

Acknowledgements

Our thanks to