The Productboard Security Team will work with you to investigate, resolve the issue promptly and reward the first reporter of a vulnerability.

Productboard Bug Bounty programs at HackerOne platform

Productboard decided to move our Bug Bounty program to HackerOne platform. The main reason is to scale up with a larger amount of incoming reports and also to provide better experience for the cooperating security researchers.

There are two programs on HackerOne:

Vulnerability Disclosure Program (VPD)

• Public program, see https://hackerone.com/productboard
• Full scope of the original in-house Bug Bounty program (*.productboard.com, *.satismeter.com)
• No financial payments in this program, only HackerOne points. But after one valid report, we invite the researcher to the paid Bug Bounty program.

Bug Bounty Program (BBP)

• Private program, only for invited researchers. Researchers will get an invitation after reporting one valid report to the VDP program.
• Financial rewards processed by HackerOne platform.
• Narrow scope: app.productboard.com only. No Satismeter or our WordPress sites.

Out of scope vulnerabilities

We are interested in critical vulnerabilities in our infrastructure and product, not in an output of automated scanners. These vulnerabilities are out-of-scope and not subject to any reward:

• Vulnerabilities without a well-documented attack vector (e.g. only missing best practices)
• Vulnerabilities found on subdomains of *.productboard.com which are not explicitly listed in scope
• Denial of service or Distributed Denial of service attacks
• Absence of rate limiting
• Permission issues in Portals and Legacy boards.
• HTML and Markdown injection in Productboard Editor and Comments
• Presence/absence/misconfiguration of SPF/DKIM/DMARC records or any email misconfiguration in general
• Lack of CSRF tokens
• Clickjacking issues
• Missing security headers which do not lead directly to a vulnerability
• Reports from automated tools or scans
• Reports of insecure SSL/TLS ciphers (unless you have a working proof of concept, and not just a report from a scanner)
• Outdated software without any noteworthy vulnerability
• Password reset token, account activation or invitation token leaks to third party services
• EXIF metadata issues
• Jira Service Desk is open to public
• Using features from higher plans and other licensing issues

Responsible Disclosure Policy

While we welcome ethical and responsible identification and investigation of potential vulnerabilities, we ask that all security researchers stick to the following principles:

• Do not engage in testing that:
• Degrades Productboard’s information systems and products.
• Results in you, or any third party, accessing, modifying, storing, sharing or destroying Productboard’s customer data.
• Includes Denial of Service or brute-force attack mechanisms
• Involves social engineering techniques
• Directly addresses Productboard customers or end users.
• Includes usage of automated tools and scanners.
• When your investigation requires authorized access (e.g. you suspect potential privilege escalation or multi-tenancy issue), create a dedicated trial account for that purpose. Never attempt to bypass our security measures under a commercial account.
• Do not exploit identified or known vulnerabilities on our infrastructure further than necessary to reasonably determine its presence. The Bounty Program is about improving security for Productboard users, not deliberately trying to put the community at risk.
• In case you encounter customer data or other information that is not your own, please stop and report this activity to our team so we can investigate. Please report to us what information was accessed and delete the data. Do not save, copy, transfer, or otherwise use this data. Continuing to access such data may demonstrate a lack of good faith.

Submission Process

Please only submit one report per issue to https://hackerone.com/productboard

When submitting a vulnerability report you agree that you may not publicly disclose your findings or the contents of your submission to any third parties in any way without Productboard’s prior written approval.

Disclosure Policy

Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.

Reward

You may be eligible to receive a reward if:

• (i) you are the first person to submit a given vulnerability;
• (ii) that vulnerability is determined to be a valid security issue by the Productboard Security Team
• (iii) you have complied with the Productboard’s Bug Bounty program policy and guidelines.

The decision to grant a reward for the discovery of a valid security issue is at Productboard’s sole discretion. The amount of each bounty is based on the classification and sensitivity of the data impacted, the completeness of your report, ease of exploit and overall risk for Productboard’s users and brand.

Legal Safe Harbor

Any activities conducted in a good faith and in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

• For more information, visit https://www.productboard.com/product/security/
• Submission reports should include a detailed description of your discovery with clear, concise steps allowing us to reproduce the issue, or a working proof-of-concept.BUT permission issues in Team spaces, New boards and Custom permission are IN-SCOPE