1Parties and Acceptance

1.1. These Program Rules (the “Rules”) apply to natural persons (each a “Researcher”) participating in the CyberBounty Program (the “Program”) operated by D-Market Elektronik Hizmetler ve Ticaret A.Ş. (“Hepsiburada”).

1.2. Each Researcher who submits a report to the Program declares that they have read, understood and accepted these Rules, the Confidentiality Agreement and the Clarification Text. Persons who do not accept the Rules may not submit reports to the Program.

2Changes to the Program

2.1. Hepsiburada reserves the right to:

• Change the scope, the lists of out-of-scope assets and vulnerabilities, the reward table and amounts, the severity rating methodology and these Rules at any time without prior notice;
• Temporarily suspend or permanently terminate the Program.

2.2. Changes take effect as soon as they are published on the Program website. The current version number and effective date are shown at the top of this text. It is the Researcher’s responsibility to review the current Rules and scope before any testing activity.

2.3. Each report is evaluated under the Rules and scope in effect on the date it was submitted. The submission date of a report and the version of the Rules accepted by the Researcher are determined by Hepsiburada’s electronic records. The parties agree that these records constitute conclusive evidence pursuant to Article 193 of the Turkish Code of Civil Procedure No. 6100.

2.4. Removing an asset from scope does not affect the evaluation of reports duly submitted before the removal date. However, testing against removed assets must stop immediately upon removal. Testing performed against an asset while it is out of scope is considered unauthorized and is not eligible for rewards.

2.5. If the Program is suspended or terminated, reports submitted after that date will not be evaluated.

3Scope and Testing Rules

3.1. Only assets explicitly listed on the Scope page may be tested. Any system not listed there is out of scope.

3.2. All test requests must include the custom header specified on the Scope page. Traffic without this header may not be recognized as testing performed under the Program.

3.3. The following activities are strictly prohibited:

• Tests that cause service disruption or resource exhaustion (DoS/DDoS);
• Social engineering, phishing and physical attacks;
• Deleting or modifying data;
• Leaving persistent access (backdoors);
• Accessing other users’ accounts or data beyond the minimum necessary to demonstrate the vulnerability;
• Automated scanning at a volume that affects the service;
• Testing third-party systems.

3.4. If personal data or confidential information is accessed during testing, the Researcher must stop testing immediately, must not retain, process or share the accessed data, and must disclose this in the report.

3.5. Testing must be performed only with accounts owned by the Researcher.

4Reporting

4.1. Each report must concern a single vulnerability and include reproduction steps and a proof of concept (PoC). Incomplete or non-reproducible reports may be closed.

4.2. Where multiple reports are received for the same vulnerability, only the first valid report is evaluated. Vulnerabilities already known to Hepsiburada are not eligible for rewards.

4.3. Multiple findings arising from the same root cause may be evaluated as a single vulnerability.

5Evaluation and Rewards

5.1. Hepsiburada determines the severity of a vulnerability based on the CVSS methodology. The score calculated by the Researcher is not binding.

5.2. Whether a reward is granted, and its amount, is at Hepsiburada’s sole discretion. The reward table is for guidance only and does not by itself create any entitlement.

5.3. A Researcher who violates these Rules forfeits any reward for the related report.

5.4. Payments are made only to an IBAN held at a bank established in Turkey. Deductions required under applicable tax legislation may be withheld from payments.

5.5. Employees of Hepsiburada and its group companies, persons employed by these companies within the last 24 months, and relevant employees of Hepsiburada’s service providers are not eligible for rewards.

6Confidentiality and Non-Disclosure

6.1. The Researcher keeps all information obtained within the Program confidential in accordance with the Confidentiality Agreement.

6.2. Even after a vulnerability has been fixed, no vulnerability, report or finding may be publicly disclosed in any medium (blog, social media, conferences, etc.) without Hepsiburada’s prior written consent.

7Safe Harbor

Hepsiburada will not initiate legal action against a Researcher for testing performed in good faith and in full compliance with these Rules. This commitment does not cover activities that violate the Rules and does not waive the rights of third parties.

8Intellectual Property

8.1. All rights to the Program website and its content belong to Hepsiburada.

8.2. The Researcher grants Hepsiburada a perpetual, royalty-free, transferable and non-exclusive right to use, reproduce and process submitted reports and their attachments.

9Removal from the Program

Hepsiburada reserves the right to remove a Researcher who violates the Rules from the Program, reject their reports and pursue legal remedies.

10Responsibility

The Researcher is solely responsible for their testing activities and for ensuring that these activities comply with applicable law. The Program is provided “as is”.

11Governing Law and Jurisdiction

These Rules are governed by Turkish law. The Courts and Enforcement Offices of Istanbul (Çağlayan) have jurisdiction over any disputes.

12Effectiveness and Precedence

12.1. These Rules take effect on the effective date stated above.

12.2. In case of conflict with the Confidentiality Agreement, the Confidentiality Agreement prevails on confidentiality matters.

12.3. In case of any discrepancy between the Turkish and English texts, the Turkish text prevails.