
Mars
External Program
Submit bugs directly to this organization
Responsible Disclosure Mars believes that the security of our services is of the utmost importance and appreciates your assistance in identifying potential vulnerabilities. This Responsible Disclosure Policy (“Policy”) provides guidance to ensure that your contribution is handled in a responsible manner. Please note, you are under no obligation to identify potential vulnerabilities. This policy describes Mars’ philosophy regarding the receipt of disclosures and its commitment to validate and fix vulnerabilities in accordance with our commitment to the Five Principles on which Mars is built.
When reporting, we ask that you complete the following steps:
Mars does not authorize, permit, or otherwise allow (expressly or impliedly) anyone to engage in any illegal activity or in violation of the Mars Terms of Use [https://www.mars.com/legal]. Therefore, we note that any party researching vulnerabilities under this Policy must do the following:
• Comply with all applicable laws relevant to security research activities. If you engage in any activities that are inconsistent with this Policy, you may be subject to criminal and/or civil liabilities. • Do Not: o Access, acquire, remove, download, or modify data residing in an account that does not belong to you; o Destroy or corrupt, or attempting to destroy or corrupt, data or information that does not belong to you; o Execute or attempt to execute any “Denial of Service” attack; o Post, transmit, upload, link to, send, or store any malicious software; o Test in a manner that would result in the sending of unsolicited or unauthorized junk mail, spam, pyramid schemes, or other forms of duplicative or unsolicited messages or degrade the operation of any Mars properties; o Testing third-party applications, websites, or services that integrate with or link to Mars properties; nor o Exploit any security vulnerability beyond the minimal amount of testing required to demonstrate that a potential vulnerability exists.
In sum, we ask that you refrain from harming or otherwise compromising Mars properties, violating Mars’ rights, the rights of third-parties, or the law.
However, if you have found a potential vulnerability (excluding the out of scope vulnerability classes listed below) on any system or asset that you believe belongs to Mars, we request that you please submit it through this program.
Some vulnerabilities classes and attacks are out of scope for our Responsible Disclosure Program. These out of scope vulnerability classes include: • Physical Testing • Social Engineering • Phishing • Denial of Service Attacks • Resource Exhaustion Attacks • Clickjacking on pages with no sensitive actions • Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions • Attacks requiring MITM or physical access to a user's device. • Previously known vulnerable libraries without a working Proof of Concept. • Comma Separated Values (CSV) injection without demonstrating a vulnerability. • Missing best practices in SSL/TLS configuration. • Any activity that could lead to the disruption of our service (DoS). • Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS • Rate limiting or brute-force issues on non-authentication endpoints • Missing best practices in Content Security Policy. • Missing HttpOnly or Secure flags on cookies • Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.) • Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version] • Software version disclosure / Banner identification issues / Descriptive error messages or headers • Tabnabbing • Issues that require unlikely user interaction
Mars will make a best effort to meet the following SLAs for hackers participating in our program:
| Type of Response | SLA in business days |
|---|---|
| First Response | 2 days |
| Time to Triage | 2 days |
| Time to Resolution | Depends on severity & complexity |
While Mars appreciates the reporting of potential vulnerabilities and does not intend to take action against entities making good faith efforts to report such vulnerabilities lawfully and in compliance with this Policy, we are not able to make such a representation on behalf of any third-party. Notably, to the extent that any security research or vulnerability disclosure activity involves the networks, systems, information, applications, products, or services of any non-Mars entity, or personal data of Mars employees, customers, suppliers or any other third party, such non-Mars entity or person may independently determine whether to pursue legal action or remedies related to such activities.
Thank you for helping us to keep our platforms safe!