alsaqi — TheRedStrike

1. Do not perform denial-of-service (DoS) attacks. 2. Social engineering attacks against employees are strictly prohibited. 3. Physical security testing is out of scope. 4. The bug-hunter is allowed to use AI scanners. 5. Allow system access if bug-hunter finds an RCE through file upload or any vector. 6. The website owners / company explicitly REQUESTED the patient data export as part of the PoC proof. This is considered normal practice for their bug bounty program and they are fully aware. 7. CONDITION: If ALL patient data is successfully retrieved, it MUST be included / attached in the final security report as evidence.

Target	Type	Status
*.alsaqi.net	web	In Scope
*.alsaqi.iq	web	In Scope
https://play.google.com/store/apps/details?id=iq.alkafeel.alsaqi_payment&hl=ar	mobile	In Scope
https://play.google.com/store/apps/details?id=net.alkafeel.arabic&hl=ar	mobile	In Scope