The Program encourages and rewards contributions by developers and security researchers who help make ELLUCIAN's assets more secure. Through the program, ELLUCIAN provides monetary rewards and recognition for security vulnerabilities responsibly disclosed to us. We use a pay per vulnerability model and utilize HackerOne platform for reports management & bounty payments.....
The following explains the details of the Program. If you are new to our Program, please be sure to review the Program Guidelines, Program Exclusions, and Terms and Conditions, as well as the Reporting and Payment Process prior to making a submission.
We request all HackerOne researchers to read our program policy thoroughly before hunting for bugs on our scope items. If you need further clarification of the rules or scope of our bug bounty program, you may email us at [email protected].
Program Guidelines
The program applies to security vulnerabilities found within ELLUCIAN's Environment. At this time, any vulnerabilities submitted that are specific to ELLUCIAN's assets (other than those in-scope) are therefore ineligible for bounty rewards. A security vulnerability is generally an error, flaw, mistake, failure, or fault in a computer program or system that impacts the security of a device, system, network, or data. Any security vulnerability may be considered for the Program; however, it must be a new, previously unreported, vulnerability in order to be eligible for reward or recognition.
Typically, in-scope submissions will include high impact vulnerabilities. However, any vulnerability that could realistically place the online security of ELLUCIAN, our customers, or the public at large at risk is in scope and might be rewarded. Vulnerabilities which directly or indirectly affect the confidentiality or integrity of user data or privacy are prime candidates for a reward. Some characteristics that are considered when "qualifying" vulnerabilities include those that:
- Directly or indirectly affect the confidentiality or integrity of user data or privacy;
- Compromise the integrity of the system;
- Enable unauthorised access to significant data or resources;
- Enable the running of unauthorised code;
- Increase privileges or access beyond that which is intended;
- Interfere with or bypass security controls or mechanisms;
- Are exploitable (i.e. not purely theoretical);
- Can be launched remotely; and
- Could cause damage to a user's system.
Program Exclusions
The following categories of vulnerabilities are excluded from reward in the Program unless otherwise directed by ELLUCIAN:
- 0-day vulnerabilities less than 30/60/90 days from patch release are ineligible for bounty;
- Attacks against ELLUCIAN infrastructure;
- Social engineering and physical attacks;
- Distributed Denial of Service attacks that require large volumes of data;
- Provisioning and/or usability issues;
- Violations of licenses or other restrictions applicable to any vendor's product;
- Security vulnerabilities in third-party products or websites that are not under ELLUCIAN’s direct control;
- Duplicate reports of security issues, including security issues that have already been identified internally;
- Tenant/cloud systems executing in an Internet Data Center (IDC), where ELLUCIAN is simply acting as the site host;
- Employee Resource Group (ERG) websites;
- Clickjacking reports against unauthenticated pages and/or static content resources;
- Reports of missing SPF records for domains with no MX record;
- Vulnerabilities that are a result of malware;
- Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited, or
- Issues determined to be low impact.
- Self-XSS involving a payload in headers or in the body of the request
- POST based Reflected XSS
- Vulnerabilities which require a social engineering component are excluded. i.e. presenting injected data to a user and expecting the user to click on an external link to complete the compromise
- Login/logout CSRF
- Content spoofing which depends on a social engineering element to succeed (such as an error page suggesting that a user take an action) is excluded
- Abandoned CNAME records require a social engineering component to successfully exploit, they are excluded unless there is an existing link from a company resource to the invalid CNAME
In addition, the submitter:
- Must not be the author of the code with the vulnerability or
- Must not be employed by ELLUCIAN directly or indirectly.
Vulnerabilities that are disclosed to any party other than ELLUCIAN, including vulnerability brokers, will not qualify for reward. This includes both public disclosure and limited private release.
Program Terms and Conditions
The following Terms and Conditions apply to the Program:
- "ELLUCIAN" refers to ELLUCIAN Services, Inc., and its affiliates.
- You must comply with the Program and abide by the law.
- ELLUCIAN employees, contractors, and their families are not eligible for rewards.
- You must submit your report as soon as you have discovered a potential vulnerability. By submitting the vulnerability, you affirm that you have not disclosed and agree that you will not disclose the vulnerability or your submission to anyone other than ELLUCIAN following the process set forth in the Program. Absent ELLUCIAN's prior written consent, any disclosure would violate the Program. It is understood and agreed that money damages would not be a sufficient remedy for any breach of this paragraph by you or your representative(s) and that ELLUCIAN shall be entitled to specific performance as a remedy for any such breach, including injunctive relief. Such remedy shall not be deemed to be the exclusive remedy for any such breach but shall be in addition to all other remedies available at law or equity to ELLUCIAN.
Submissions selected for rewards, and the individuals who submitted the vulnerabilities will receive recognition at the sole discretion of ELLUCIAN.
- By submitting information about a potential vulnerability, you agree to all Program Terms and Conditions and grant ELLUCIAN a worldwide, royalty-free, non-exclusive license to use your submission. Only the first submission of a given potential vulnerability that ELLUCIAN has not yet identified is eligible. In the event of a duplicate submission, only the earliest received is considered.
- Eligibility for rewards, including the determination of the recipients and reward amount is left up to the sole discretion of ELLUCIAN.
- Out of scope vulnerabilities submitted are generally less likely to receive recognition or rewards under the Program.
- You are responsible for complying with all applicable laws in connection with your participation in the program, as well as all taxes associated with and imposed on any reward you may receive in connection with your submission. HackerOne handles all bounty payments through the HackerOne platform. Please refer to HackerOne’s relevant policies here.
- You may only exploit, investigate, or target vulnerabilities against your own accounts. Testing must not violate any law, or disrupt or compromise any data or access data that is not yours; intentional access of customer data other than your own is expressly prohibited.
- If you inadvertently access customer, employee, or business related information during your testing, you must immediately notify ELLUCIAN and the information must not be used, disclosed, stored, or recorded in any way. Inadvertent access of the data must be declared within your submission.
- Your testing activities must not negatively impact ELLUCIAN, or ELLUCIAN's Environment availability or performance.
- ELLUCIAN reserves the right of non-remediation in its sole discretion.
- The Program constitutes the entire agreement and understanding of the parties with respect to the items listed herein. The Program may be amended or modified any time without notice in ELLUCIAN’s sole and absolute discretion.
*This program is not open to minors, individuals who are on sanctions lists, or who are in or a national or resident of any country to which the United States has embargoed goods. country.
- If any portion of the Program is found to be illegal or unenforceable, then the parties shall be relieved of their responsibilities arising under such portion, but only to the extent that such portion is illegal or unenforceable.
Reporting Process
When reporting vulnerabilities, you must first register or log on to your account on HackerOne. In describing the vulnerability it is important to include all necessary details required for reproducing the vulnerability as well as the tools required to reproduce the vulnerability. Please note that the vulnerability should be treated in accordance with the terms of the Program.
- Each submission will typically receive a reply within one (1) business day acknowledging that the report was successfully received.
- Duplicate submissions (where the vulnerability has already been reported to ELLUCIAN are not eligible for rewards. In most instances, you will not be notified of a duplicate report condition until after the vulnerability has been remediated.
- Please recognise that ELLUCIAN operates a complex Environment and the amount of time required to address a reported issue can vary from a few hours to several months. You will receive notification of the final outcome of our remediation efforts once the Program is notified by ELLUCIAN internal support team. ELLUCIAN cannot provide updates on remediation efforts that are in progress..
THE CRITERIA USED TO DETERMINE THE PAYOUT FOR A VULNERABILITY IS SOLELY AT THE DISCRETION OF ELLUCIAN.
Change to Program Terms
ELLUCIAN reserves the right to change or discontinue the Program at any time without notice in its sole discretion.
