With the best interest in mind for Farfetch and all Security Researchers, the following bugs or vulnerabilities classes should not be considered for reporting:
- Account/e-mail enumeration using brute-force attacks
- API keys disclosure without proven business impact
- Blind SSRF without proven business impact (pingbacks aren't sufficient)
- Broken links
- Bugs in content/services that are not owned/operated by Farfetch
- Bypassing content restrictions in uploading a file without proving the file was received
- Bypassing rate-limits or the non-existence of rate-limits
- Clickjacking/UI redressing
- Client-side application/browser autocomplete or saved password/credentials
- Content injection without code execution or proven business impact
- Cross-site Request Forgery with no or low impact
- CSV Injection
- Descriptive or verbose error pages without proof of exploitability or obtaining sensitive information
- Directory structure enumeration (unless the fact reveals exceptionally useful information)
- Disclosed/misconfigured Google Maps API keys
- Homograph attacks
- Host header injection without impact
- HTTP Request smuggling without any proven impact
- Incomplete or missing SPF/DMARC/DKIM records
- Issues related to password/credential strength
- Lack of SSL or Mixed content
- Low impact Information disclosures (including Software version disclosure)
- Missing cookie flags
- Missing/Enabled HTTP Headers/Methods which do not lead directly to a security vulnerability
- Not stripping metadata of files
- Reverse tabnabbing
- Scan reports from automated tools of any kind (e.g. SSL/TLS, Nessus, Accunetix, etc)
- Self-exploitation (e.g. password reset links or cookie reuse)
- Self-XSS that can't be used to exploit other users
- Sessions not being invalidated (logout, enabling 2FA, etc.)
- SSL/TLS best practices that do not contain a fully functional proof of concept
- Subdomain takeover
- Tokens leaked to third parties
- Use of a known-vulnerable library without evidence of exploitability