Security is core to our values, and we value the input of hackers acting in good faith to help us maintain a high standard for the security and privacy for our users. This includes encouraging responsible vulnerability research and disclosure. This policy sets out our definition of good faith in the context of finding and reporting vulnerabilities, as well as what you can expect from us in return.
We provide rewards to vulnerability reporters at our discretion. In order to be eligible for a bounty, your submission must be accepted as valid.
The guidelines we use to determine the validity of requests and the reward compensation offered are listed in our awards table.
Our security engineers must be able to reproduce the vulnerability you have reported. Reports that include clearly written explanations and working proof of concept are more likely to receive awards.
Our focuses for security research are listed as 'Vulnerabilities In Scope' with their priority indicated. More impactful bugs will receive larger awards.
Reward amounts may vary depending upon the severity of the vulnerability reported and quality of the report. If we receive multiple reports of the same vulnerability, the first clear, reproducible report will be rewarded.
We may decide to pay higher rewards for clever or severe vulnerabilities, decide to pay lower rewards for vulnerabilities that require unusual user interaction, decide that a single report constitutes multiple bugs, or that multiple reports are so closely related that they only warrant a single reward.
We would very much like to highlight the incredible work that external researchers do for us and one way we can do that is to publicly disclose vulnerabilities in a timely manner with proper attribution. To facilitate this, please:
- Share the security issue with us in detail
- Give us a reasonable time to remediate the issue before making any information about it public.
- When we have remediated the issue, remain in communication to coordinate public disclosure timelines.
We require that all researchers:
- Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data during security testing;
- Perform research only within the scope set out below;
- Be clear and succinct, a short proof-of-concept link is invaluable.
- Use the identified communication channels to report vulnerability information to us; and
- Keep information about any vulnerabilities you’ve discovered confidential until we’ve had [90] days to resolve the issue.
- Be respectful of our existing applications. Respect their Terms of Service and avoid scanning techniques that are likely to cause degradation of service to other customers.
- nly interact with your own accounts or test accounts for security research purposes. Do not access or modify our data or our users' data, without the explicit permission of the owner.
- Act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services (including denial of service).
- Otherwise comply with all applicable laws.
If you follow these guidelines when reporting an issue to us, we commit to:
- Not pursue or support any legal action related to your research;
- Work with you to understand and resolve the issue quickly (including an initial confirmation of your report within 72 hours of submission);
- Recognize your contribution on our Security Researcher Leaderboard, if you are the first to report the issue and we make a code or configuration change based on the issue.
The applications listed under 'vulnerabilities-in-scope' are explicitly eligible for the bounty program.
Any design or implementation issue that substantially affects the confidentiality or integrity of user data is likely to be in scope for the program. Common examples include:
- Cross-site scripting.
- Cross-site request forgery.
- Authentication or authorization flaws.
- Server-side code execution bugs.
- Circumvention of our permissions model.
- SQL injection.
- XML external entity Attacks.
While this list represents our primary focus for security research, we are interested in reports for all of our software and dependencies especially if it impacts reasonably sensitive user data. This can include any open source libraries, software, or third-party components. At our discretion, we will issue rewards for reports not included in the vulnerabilities-in-scope list.
The applications listed under 'vulnerabilities out of scope' are explicitly ineligible. We will not disclose vulnerabilities reported regarding out of scope applications, nor will we issue rewards for them.
In addition, the following issues are outside of the scope of our rewards program:
- Policies on presence/absence of SPF/DMARC records.
- Password, email and account policies, such as email id verification, reset link expiration, and password complexity.
- Logout cross-site request forgery.
- Attacks requiring physical access to a user's device.
- XSS on any site other than those listed as 'in scope'.
- Attacks that require attacker app to have the permission to overlay on top of our app (e.g., tap jacking).
- Vulnerabilities that require a potential victim to install non-standard software or otherwise take active steps to make themselves be susceptible.
- Vulnerabilities affecting users of outdated browsers or platforms.
- Social engineering of our employees or contractors.
- Any physical attempts against our property or data centers.
- Presence of autocomplete attribute on web forms.
- Missing cookie flags on non-sensitive cookies.
- Any access to data where the targeted user needs to be operating a rooted mobile device.
The following issues are outside the scope of our rewards program unless they are accompanied by evidence of exploitability:
- Use of a known-vulnerable library.
- Missing best practices.
- Insecure SSL/TLS ciphers.
- Missing security headers which do not lead directly to a vulnerability.
- Lack of CSRF tokens (unless there is evidence of actual, sensitive user action not protected by a token).
- Host header injections.
- Reports from automated tools or scans that haven't been manually validated.
- Presence of banner or version information unless correlated with a vulnerable version.
For more additional information about issues that are commonly out of scope, refer to Google Bughunter University.
Any issues already known to us will be published as a Known Issues list. These vulnerabilities are considered out of scope, but additional reports of them may qualify for awards if they are new instances which were not previously observed.
We will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy.
We consider activities conducted consistent with this policy to constitute 'authorized' conduct under the Cybercrime Prevention Act of 2012.
To the extent your activities are inconsistent with certain restrictions in our Acceptable Use Policy, we waive those restrictions for the limited purpose of permitting security research under this policy.
We will not bring a DMCA claim against you for circumventing the technological measures we have used to protect the applications in scope.
If legal action is initiated by a third party against you, and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Please submit a report to us before engaging in conduct that may be inconsistent with or unaddressed by this policy.
This is not a competition, but rather an experimental and discretionary rewards program. We may modify the terms of this program, terminate this program at any time, or not pay a reward entirely at our discretion.
We won't apply any changes we make to these program terms retroactively. Reports from individuals who we are prohibited by law from paying are ineligible for rewards. You are responsible for paying any taxes associated with rewards. Any rewards that are unclaimed after 12 months will be donated to a charity of our choosing.