Vulnerability Disclosure Policy

Keeping user information safe and secure is of the utmost importance and a core company value, and we can't feasibly accomplish that without the help of external security researchers. Consequently, we have formalized a vulnerability disclosure policy and reward program in order to be able to show appreciation for their effort, skill and dedication.

Rewards

We provide rewards to vulnerability reporters at our discretion. In order to be eligible for a bounty, your submission must be accepted as valid.

The guidelines we use to determine the validity of requests and the reward compensation offered are listed in our awards table.

Reproducibility

Our engineers must be able to reproduce the vulnerability you have reported. Reports that include clearly written explanations and a working proof of concept are more likely to receive awards.

Severity and Priority

Our focuses for security research are listed as 'in-scope' with their priority indicated. More impactful bugs will be receive larger awards.

Rewards

Reward amounts may vary depending upon the severity of the vulnerability reported and quality of the report. If we receive multiple reports of the same vulnerability, the first clear, reproducible report will be rewarded.

We may decide to pay higher rewards for clever or severe vulnerabilities, decide to pay lower rewards for vulnerabilities that require unusual user interaction, decide that a single report constitutes multiple bugs, or that multiple reports are so closely related that they only warrant a single reward.

Disclosure

We would very much like to highlight the incredible work that external researchers do for us and one way we can do that is to publicly disclose vulnerabilities in a timely manner with proper attribution. To facilitate this, please:

• Share the security issue with us in detail
• Give us a reasonable time to remediate the issue before making any information about it public.
• When we have remediated the issue, remain in communication to coordinate public disclosure timelines.

Guidelines for investigating and reporting bugs

• Be clear and succinct, a short proof-of-concept link is invaluable. Visit the Bug Hunter University articles to learn more about sending good vulnerability reports.
• Be respectful of our existing applications. Respect their Terms of Service and avoid scanning techniques that are likely to cause degradation of service to other customers.
• Do not access or modify our data or our users' data, without explicit permission of the owner. Only interact with your own accounts or test accounts for security research purposes.
• Contact us immediately if you do inadvertently encounter user data. Do not view, alter, save, store, transfer, or otherwise access the data, and immediately purge any local information upon reporting the vulnerability.
• Act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services (including denial of service).
• Otherwise comply with all applicable laws.

In Scope

The applications listed under 'in-scope' are explicitly eligible for the bounty program.

Any design or implementation issue that substantially affects the confidentiality or integrity of user data is likely to be in scope for the program. Common examples include:

• Cross-site scripting.
• Cross-site request forgery.
• Mixed-content scripts.
• Authentication or authorization flaws.
• Server-side code execution bugs.
• Circumvention of our permissions model.
• SQL injection.
• XML external entity Attacks.

While this list represents our primary focus for security research, we are interested in reports for all of our software and dependencies especially if when it impacts reasonably sensitive user data. This can include any open source libraries, software, or third-party components. At our discretion, we will issue rewards for reports not included in the in-scope list.

Out of Scope

The applications listed under 'out of scope' are explicitly ineligible. We will not disclose vulnerabilities reported regarding out of scope applications, nor will we issue rewards for them.

In addition, the following issues are outside of the scope of our rewards program:

• Policies on presence/absence of SPF/DMARC records.
• Password, email and account policies, such as email id verification, reset link expiration, and password complexity.
• Logout cross-site request forgery.
• Attacks requiring physical access to a user's device.
• XSS on any site other than those listed as 'in scope'.
• Attacks that require attacker app to have the permission to overlay on top of our app (e.g., tapjacking).
• Vulnerabilities that require a potential victim to install non-standard software or otherwise take active steps to make themselves be susceptible.
• Vulnerabilities affecting users of outdated browsers or platforms.
• Social engineering of our employees or contractors.
• Any physical attempts against our property or data centers.
• Presence of autocomplete attribute on web forms.
• Missing cookie flags on non-sensitive cookies.
• Any access to data where the targeted user needs to be operating a rooted mobile device.

The following issues are outside the scope of our rewards program unless they are accompanied by evidence of exploitability:

• Use of a known-vulnerable library.
• Missing best practices.
• Insecure SSL/TLS ciphers.
• Missing security headers which do not lead directly to a vulnerability.
• Lack of CSRF tokens (unless there is evidence of actual, sensitive user action not protected by a token).
• Host header injections.
• Reports from automated tools or scans that haven't been manually validated.
• Presence of banner or version information unless correlated with a vulnerable version.

For more additional information about issues that are commonly out of scope, refer to Google Bughunter University.

Known Issues

Any issues already known to us will be published as a Known Issues list. These vulnerabilities are considered out of scope, but additional reports of them may qualify for awards if they are new instances which were not previously observed.

Consequences of Complying with This Policy

We will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy.

We consider activities conducted consistent with this policy to constitute 'authorized' conduct under the Computer Fraud and Abuse Act.

To the extent your activities are inconsistent with certain restrictions in our Acceptable Use Policy, we waive those restrictions for the limited purpose of permitting security research under this policy.

We will not bring a DMCA claim against you for circumventing the technological measures we have used to protect the applications in scope.

If legal action is initiated by a third party against you and you have complied with this policy policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Please submit a report to us before engaging in conduct that may be inconsistent with or unaddressed by this policy.

The Fine Print

This is not a competition, but rather an experimental and discretionary rewards program. We may modify the terms of this program, terminate this program at any time, or not pay a reward entirely at our discretion.

We won't apply any changes we make to these program terms retroactively. Reports from individuals who we are prohibited by law from paying are ineligible for rewards. You are responsible for paying any taxes associated with rewards. Any rewards that are unclaimed after 12 months will be donated to a charity of our choosing.