Promo's Bug Bounty Program

Guidelines

We encourage you to contact us to report potential vulnerabilities in our Services via our designated email address available at [[email protected]], pursuant to this Policy. By emailing us any information to this email address, you confirm that you have read and agree to this Security Vulnerabilities Bounty Policy.

Under this policy, an eligible “activity” means anything in which you comply with all of the following:

• Are the first to notify us in writing after discovery of a proven or potential information security issue that occurs on the publicly available Services, such notification being with a clear Report (as described below) following your own original research.
• You are 18 years of age or older at the time of participation. If you are under the age of 18, you may not participate in the Bounty in any way.
• You are not a resident of a country subject to trade sanctions or embargoes and are not an individual listed on trade sanctions lists or embargo lists.
• Not engage in any privacy or data protection-related violations, degradation of user experience, disruption of the Promo Services, or disclosure, destruction, or manipulation of data on the Services.
• Only investigate exploits to the extent necessary to confirm a vulnerability and not to compromise or exfiltrate data, establish persistent command line access, or pivot to other services. 
• Provide us with the required amount of time to mitigate the vulnerability and to verify the fix we’ve applied for it with a re-test before any disclosure of the matter to a third party or publicly.
• Do not submit a high volume of low-quality Reports.
• Comply with all applicable laws including local laws which apply to you.

Once you’ve established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), you must promptly stop your test or investigation, notify us immediately, and not disclose to anyone else the data or the information related to the vulnerability on the Services.

What we would like to see in Reports:

In order to help us triage and prioritize submissions and to meet the clear reporting requirements under this Policy, we require that your Reports:

• Be in English
• Describe in detail where and how the vulnerability was discovered and the potential impact of its exploitation. 
• Include a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts, screenshots, videos, system diagnosis reports, and crash logs are helpful).

You may be rewarded for eligible Reports under the following additional conditions:

• Bounty payments are granted at Promo’s reasonable discretion of the reward factors specified below and subject to the reward ranges indicated below.
• Individuals under the age of 18 that have submitted Reports as part of the Bounty will not be eligible to reward of any kind.
• Promo will aim to review and respond to all valid Reports within 7 business days of Promo receiving your submission. Promo will prioritize Reports based on the severity of the vulnerability submitted.
• Promo may notify you of your eligibility and ask you to provide additional details to receive your reward. Following Promo’s receipt of your timely response with the additional information requested, Promo will remit the reward in USD within thirty (30) business days through one of the following payment methods (at Promo’s choice): PayPal, Wire transfer.
• You are responsible for any applicable taxes, tax filings or reports, and tax payments due, under the tax laws that apply to you with respect to the reward you receive. 

Discretionary factors impacting the amount of the reward for a Report include (but are not limited to):

• The assessed level of access or execution achieved by the Reported issue
• The assessed quality of the Report.
• The assessed extent and scope of effect on Promo’s Services.
• The assessed extent and scope of effect on Promo.com’s user’s data confidentiality and integrity.
• The assessed degree of uniqueness of the Reported issue to Promo’s newly added code and features.
• The assessed extent and scope of impact on sensitive components.
• The assessed degree of novelty of the Reported issue