
Fastly VDP
External Program
Submit bugs directly to this organization
#About Fastly Fastly helps people stay connected with the things they love. Fastly’s edge cloud platform enables customers to create great digital experiences quickly, securely, and reliably by processing, serving, and securing our customers’ applications as close to their end-users as possible — at the edge of the Internet. The platform is designed to take advantage of the modern internet, to be programmable, and to support agile software development. Fastly’s customers include many of the world’s most prominent companies, including Vimeo, Pinterest, The New York Times, and GitHub. We're building a more trustworthy Internet. Fastly looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.
We're building a more trustworthy Internet.
Fastly looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.
Your participation in the Fastly Vulnerability Disclosure Program is voluntary. By submitting a report or otherwise disclosing a vulnerability to us (a “Submission”), you are indicating that you have read and agree to follow the rules set forth on this page (“Program Terms”).
During security research, user privacy must be maintained and respected. Testing should be performed only on assets explicitly stated as in-scope for the vulnerability disclosure program. Testing must be performed in accordance with the Program Terms and Fastly’s Terms of Service. Testing should not degrade, damage, or destroy our systems - research which includes actions that result in denial of service is strictly prohibited. If a vulnerability is found, report it without any conditions attached. Any vulnerabilities found that are disclosed for purposes other than for fixing the issue will not qualify for a reward. Only interact with accounts you own or with explicit permission of the account holder. Fastly reserves the right to end the vulnerability disclosure program at any time.
Fastly will make a best effort to meet the following SLAs for security researchers participating in our program:
| Type of Response | SLA in business days |
|---|---|
| First response | 3 days |
| Time to Triage | 7 days |
| Time to Swag | 30 days |
| Time to resolution | Dependent on severity and complexity of the issue. |
The following issues are what the Fastly team is most interested in seeing:
The following activities are prohibited:
The following issues are out of scope:
Before beginning your report, ensure that the issue is in scope for this program and shows security impact.
Notes:
Only vulnerabilities that are verifiable and reproducible are considered in-scope. Reports should have the following qualities:
Vulnerability Reports should avoid:
Any information you receive or collect about us, our services, our customers, our affiliates or any of our users, employees or agents in connection with the Vulnerability Disclosure Program (“Confidential Information”) must be kept confidential and only used in connection with the Vulnerability Disclosure Program. You may not use, disclose or distribute any such Confidential Information, including without limitation any information regarding your Submission, without our prior written consent. You must get written consent by submitting a disclosure request through the HackerOne platform. Please note, not all requests for public disclosure can be approved.
We may modify the Program Terms or cancel the Vulnerability Disclosure Program at any time in our sole discretion. By making a Submission, you represent and warrant that the Submission is original to you and you have the right to submit the Submission. By making a Submission, you give us the right to use your Submission and any materials submitted with your Submission for any purpose.
Fastly will not pursue legal action against any security researcher who complies with all of the Program Terms, and who also cooperates fully with Fastly's reasonable requests for assistance in reproducing a vulnerability.