Productboard decided to move our Bug Bounty program to HackerOne platform. The main reason is to scale up with a larger amount of incoming reports and also to provide better experience for the cooperating security researchers.
There are two programs on HackerOne:
We are interested in critical vulnerabilities in our infrastructure and product, not in an output of automated scannersThese vulnerabilities are out-of-scope and not subject to any reward:
Denial of service or Distributed Denial of service attacks
Presence/absence/misconfiguration of SPF/DKIM/DMARC records or any email misconfiguration in general
Lack of CSRF tokens
Clickjacking issues
Missing security headers which do not lead directly to a vulnerability
Missing best practices (we require exploitable evidence of a security vulnerability)
Reports from automated tools or scans
Reports of insecure SSL/TLS ciphers (unless you have a working proof of concept, and not just a report from a scanner)
Absence of rate limiting
Outdated software without any noteworthy vulnerability
Permission issues within a single business space.
BUT permission issues in Team spaces, New boards and Custom permission are IN-SCOPE.
HTML Injection for Productboard Editor (comments, descriptions, details, etc.)
Password reset token leaks to third party services
EXIF metadata issues
Jira Service Desk is open to public
Using features from higher plans and other licensing issues
When submitting a vulnerability report you agree that you may not publicly disclose your findings or the contents of your submission to any third parties in any way without Productboard’s prior written approval.
You may be eligible to receive a reward if:
The decision to grant a reward for the discovery of a valid security issue is at Productboard’s sole discretion. The amount of each bounty is based on the classification and sensitivity of the data impacted, the completeness of your report, ease of exploit and overall risk for Productboard’s users and brand.
Any activities conducted in a good faith and in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
