Code of Conduct

Who We Are and What We Require

Our top core values are simple. We don’t believe in unnecessarily complicating things.

• Be kind.
• Be respectful and professional in your communications and behavior, and in compliance with the Platform Behavior Standards.
• Be Ethical. Don’t intentionally mislead customers or Bugcrowd. It is your job to try and break both technology and business logic flaws, but when you find a weakness it is also your job to report it to be fixed – not exploit it.
• Help us improve. We do this through honest and insightful discussions with our peers and partners.

Vulnerability Reporting Standards

Be prompt in reporting vulnerabilities you have identified.

• Disclosure Guidelines: Don’t share confidential vulnerability or customer information. Private program customers are private, and no submitted vulnerability (including duplicates, Out of Scope, Not Applicable, etc.) may be disclosed without explicit customer permission. Please read each Bounty Brief for specific program disclosure policies, which supersede (overrule) this policy. We expect everyone to use the proper channels to disclose or communicate about vulnerability submissions. Email Bugcrowd Support if you have any questions about disclosure.
• If a vulnerability provides unintended access to data: Limit the amount of data you access to the minimum required for effectively demonstrating the impact of the vulnerability; and cease testing and submit a report immediately if you encounter any user data during testing, such as Personally Identifiable Information (PII), Personal Healthcare Information (PHI), credit card data, or proprietary information. In the event you access PII or other sensitive data, please note that you are required to follow all laws and regulations applicable to the access and processing of such personally identifiable information and/or data, such as the European Union’s General Data Protection Regulation (Regulation (EU) 2016/679), including the European Commission’s Standard Contractual Clauses regarding the transfer of personal data to processors and the California Consumer Privacy Act of 2018, and the California Privacy Rights Act of 2020 once it becomes effective.
• It is not acceptable to create placeholder submissions that are used to “squat” on findings (e.g. reports that are rapidly submitted a vague title and no detailed replication steps in the initial report, etc); all valid findings must be submitted with a full description, proof of concept, and complete replication steps in the original report. In cases where the initial report is lacking a description, proof of concept, and replication steps, those reports will be closed, and must be re-submitted with the required information to be considered for the program. Please always submit complete, fully populated, and articulate reports.
• Read and abide by Bugcrowd’s Standard Disclosure Terms and each program’s Bounty Brief. We expect you to follow all guidelines and rules that a particular crowdsourced security program or company has outlined regarding scope of testing and disclosure. For more information on disclosure policies at Bugcrowd, visit the Researcher Documentation Centre, our Researcher Resources, or FAQ.