Work at Majid Al Futtaim Properties? Claim it to respond to reviews as the verified owner.
Found a vulnerability?
If you would rather not deal with the vendor yourself, a BugRater analyst will submit it upstream on your behalf, with your explicit permission, and tell you what came back.
Ask BugRater to submit itPrivate. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.
Reviews
0 publishedNo reviews yet.
Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 20 Sep 2026.
Majid Al Futtaim Properties invites you to test and help secure our primary publicly facing assets - focusing on our web and mobile applications. We appreciate your efforts and hard work in making the internet more secure, and look forward to working with the researcher community to create a meaningful and successful bug bounty program. Good luck and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Valid P4 reports will be upgraded to P3 and paid at the following range: $150 - $200
Scope
24 assets| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| Belong by MAF (Android) | android | ✓ bounty | not set |
| Belong by MAF (iOS) | ios | ✓ bounty | not set |
| City Centre | android | ✓ bounty | not set |
| City Centre Al Barsha | website | ✓ bounty | not set |
| City Centre Deira | website | ✓ bounty | not set |
Show all 24 assets
| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| Ecoupon | website | ✓ bounty | not set |
| Ghafwoods Website | website | ✓ bounty | not set |
| https://api.mafshoppingmalls.com | api | ✓ bounty | not set |
| https://api.mafshoppingmalls.com/ | api | ✓ bounty | not set |
| https://apps.apple.com/app/mall-of-the-emirates-moe/id1449578693 | ios | ✓ bounty | not set |
| https://maf-properties-prod.apigee.net | api | ✓ bounty | not set |
| https://play.google.com/store/apps/details?id=com.belongi.moe | android | ✓ bounty | not set |
| https://smbu-api.maf.ae/ | api | ✓ bounty | not set |
| https://www.citycentremalls.com/en | website | ✓ bounty | not set |
| https://www.malloftheemirates.com | website | ✓ bounty | not set |
| Junction Website | website | ✓ bounty | not set |
| MAF Properties Website | website | ✓ bounty | not set |
| Mall of Egypt Android | android | ✓ bounty | not set |
| Mall of Egypt iOS | ios | ✓ bounty | not set |
| Mall of the Emirates | android | ✓ bounty | not set |
| Mall of the Emirates IOS | ios | ✓ bounty | not set |
| Partner Connect | website | ✓ bounty | not set |
| Sitefinity Portal | website | ✓ bounty | not set |
| Tilal Al Ghaf Website | website | ✓ bounty | not set |
Bugcrowd lists 25 scope entries; its public listing groups many assets under one label, so identical entries are shown once.