
Avalara
External Program
Submit bugs directly to this organization
#Welcome to Avalara!
Avalara helps businesses of all sizes get tax compliance right. In partnership with leading ERP, accounting, ecommerce, and other financial management system providers, Avalara delivers cloud-based compliance solutions for various transaction taxes, including sales and use, VAT, GST, excise, communications, lodging, and other indirect tax types.
At Avalara, we work hard to protect our products and services against security threats. We’re committed to partnering with the security community to find security vulnerabilities through our Vulnerability Disclosure Program. We appreciate your help in keeping our business and customers safe.
We will recognize the first security researcher who reports a valid and unknown-to-us vulnerability once the vulnerability is verified and addressed. We do not offer compensation for disclosures at this time.
When researching and disclosing a vulnerability, please:
Please do not:
Avalara employees and contractors are not eligible for this Program and should report any vulnerabilities through appropriate internal mechanisms.
Vulnerabilities that are not easily exploitable and have low security impact do not qualify for this Program. For example, the following issues are considered out-of-scope:
We treat all reports through this Program with high priority. We aim to meet the following response targets for submissions to this Program:
• Time from report submission to first response: 1-2 business days • Time from report submission to triage: 3-5 business days
We will strive to keep you informed about our progress throughout the process.
We will not initiate a lawsuit or law enforcement investigation against you for security research and vulnerability disclosure activities conducted in compliance with this Policy.
If legal action is initiated by a third party against you in connection with activities conducted under this Policy, we will take steps to make it known that your actions were conducted in compliance with this Policy. We cannot and do not authorize security research in the name of other entities.
Nothing in this Policy, including submission of a report, should be deemed to constitute the grant to you of any license or any other right to or in respect of any Avalara or third-party product, service, patent trademark, trade secret, or other intellectual property. By submitting a report, you grant Avalara a perpetual, worldwide, exclusive, fully-paid-up license to sublicense, copy, distribute, display, perform, transmit, and publish the report.
Avalara will determine, in its sole discretion, whether recognition will be provided for reporting a vulnerability, and it reserves the right to withhold such recognition. Violation of this Policy may result in removal from the Program and ineligibility for any future bug bounty opportunities. By submitting a report or otherwise participating in this Program, you agree that you have read and will follow this Policy. Avalara reserves the right to update this Policy without notice and to terminate this Program without notice.
Thank you for helping keep Avalara and our customers safe!