Doppler believes that working with skilled security researchers across the globe is crucial in identifying potential security vulnerabilities. If you believe you have found a security issue in our product or service, please notify us. We will make every effort to promptly resolve the issue.

** Register all test accounts using your <username>[email protected] address. **

Response Targets

Doppler will make a best effort to meet the following SLAs for hackers participating in our program:

We’ll try to keep you informed about our progress throughout the process.

Disclosure Policy

• Submit a detailed report with steps to reproduce, screenshots, and anything else that will help validate your finding
• We will inform you of remediation and may ask you to help confirm the fix
• Do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
• Follow HackerOne's disclosure guidelines.

Vulnerability Scoring

We will use CVSS 3.1 to guide our initial scoring, however Doppler reserves the right to adjust the score based on other qualitative factors. For example, a vulnerability leaking customer secrets would typically be ranked more highly than one leaking customer contact information.

Program Rules

• Register all accounts using your <username>[email protected] address.
• Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
• Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
• When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
• Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
• Social engineering (e.g. phishing, vishing, smishing) is prohibited.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
• Please keep account creation for this program to no more than 3 accounts.

Common Reports and Out of Scope Vulnerabilities

BugSnag API Key in Frontend Source Code: This API key is intentionally available publicly. The BugSnag API key is write-only and can only be used report bugs; this key must be exposed in the source code in order for the client JS library to detect and report client-side errors. More information is available here: https://github.com/bugsnag/bugsnag-js/issues/595

The following issues are considered out of scope:

• MFA bypass when using Google Auth/SAML (intended behavior)
• Referral credit accumulation using enumerated/deleted accounts (accepted risk)
  • Note: findings that allow you to accumulate more than $500 in referral credit ARE valid
• Issues related to team trial billing
  • Note: findings related to sustained free access to the team plan after 70 days ARE valid
• Issues related to exceeding the free seat limit on the Developer plan
• Issues related to multiple activations of the GitHub Student Developer Pack discount
• Attacks that allow you to exceed resource limits by switching between plans
• Attacks requiring MITM or physical access to a user's device.
• Previously known vulnerable libraries without a working Proof of Concept.
• Any activity that could lead to the disruption of our service (DoS).
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
• Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
• Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.
• Tabnabbing
• Issues that require unlikely user interaction
• Issues where the system is working as intended but documentation is incorrect (we may award a small bounty for these at our discretion)

Exclusions

While researching, please refrain from:

• Denial of service
• Brute forcing
• Spamming
• Social engineering (including phishing) of Doppler staff, contractors, or customers
• Any physical attempts against Doppler property or data centers

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep Doppler and our users safe!