
Databricks
External Program
Submit bugs directly to this organization
As part of Databricks’ commitment to security, we reward security researchers who find and report to us critical security vulnerabilities and help us keep our business and customers safe. By participating in this program, you are agreeing to the Databricks terms and conditions.
Free Edition: Sign up here for a personal workspace. This edition has specific limitations, such as the absence of Scala and custom compute. Enterprise Workspace: To test features not available on Free Edition, use the HackerOne Request Credential button. You will be invited to a managed workspace. Note: You will not have administrative privileges in this environment.
| Project | Details |
|---|---|
| Apache Spark | Apache Software Foundation is the Official Owner / Maintainer of Apache Spark. Please follow their security guidelines for vulnerabilities involving Apache Spark. |
| MLFlow | Databricks Managed MLFlow differs from its open-source cousin. Please report issues with Databricks Managed MLFlow to this program and issues with open source MLFlow via their security page. |
| Redash | Redash is an open source project owned by the community. Please refer to their security policy to report issues with Redash. |
Applicable Laws. You must comply with all applicable laws, including local laws of the country or region in which you reside or in which you access or use Databricks services. Bounty. Databricks bug bounties are granted solely at Databricks’ discretion. Data. Your testing must not violate any law, or disrupt, compromise or damage data or property that is not your own. This includes attacking any devices or accounts other than your own (or those for which you have express written permission) and using social engineering (e.g., phishing, vishing, smishing) techniques. However, finding technical flaws that can be used for social engineering, such as spoofing or tampering, is allowed. Finances. You are responsible for any tax implications depending on your country of residency and citizenship. There may be additional restrictions on your ability to participate depending upon your local law. General Eligibility & Sanctions. We are unable to issue rewards to individuals who are employed by Databricks, Inc.; are an immediate family member of a person employed by Databricks, Inc.; or have less than 18 years of age. We are also unable to issue rewards to individuals who are in any U.S. embargoed countries or on the U.S. Department’s list of Specially Designated Nationals or the U.S. Department of Commerce Denied Persons List or Entity List or any other restricted party lists. Research. Immediately both stop your research and notify Databricks using the reporting process before any of the following occur: * You access any accounts or data other than your own (or those for which you have express written permission from their owners) * You disrupt any Databricks service * You access a non-customer facing Databricks system.
If you have already accessed data other than your own, and acquired it, contact us immediately, and securely purge any data you have acquired upon reporting the vulnerability to Databricks.