{"count":3,"next_page":null,"page":1,"page_count":1,"per_page":30,"previous_page":null,"articles":[{"id":23492095445779,"url":"https://bprd.zendesk.com/api/v2/help_center/en-us/articles/23492095445779.json","html_url":"https://bp.responsibledisclosure.com/hc/en-us/articles/23492095445779-ResponsibleDisclosure-com-s-Terms-of-Service","author_id":10283501135507,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":23487434575251,"created_at":"2023-11-28T18:39:22Z","updated_at":"2023-11-28T20:21:00Z","name":"ResponsibleDisclosure.com's Terms of Service","title":"ResponsibleDisclosure.com's Terms of Service","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2023-11-28T20:21:00Z","user_segment_id":null,"permission_group_id":1709674,"content_tag_ids":[],"label_names":[],"body":"<h1 id=\"h_01HGBK5VE9D5R5C4T28BFDDG7M\"><span class=\"wysiwyg-font-size-large\"><strong>I. Overview</strong></span></h1>\n<p>The following terms of use (the “Terms of Use”) apply when you view or use the website located at ResponsibleDisclosure.com (the “Site”). By using our Site, you agree to fully comply with and be bound by the Terms of Use. Please review them carefully. If you do not accept our Terms of Use, do not access and use our Site. If you have already accessed our Site and do not accept our Terms of Use, you should immediately discontinue use of our Site. Synack commits that, if we conclude, in our sole discretion, that a security vulnerability submitted through the Site complies with the Terms of Use and the applicable Responsible Disclosure Guidelines, Synack will not bring a private action against you or refer the matter for public inquiry.</p>\n<h2 id=\"h_01HGBK9937NW2C88N323A010FH\"><span class=\"wysiwyg-font-size-large\"><strong>II. Privacy Policy</strong></span></h2>\n<p>We respect the privacy of our Site visitors. Please refer to our Privacy Policy which explains how we collect, use, and disclose information that pertains to your privacy. When you access or use the Site, you signify your agreement to this Privacy Policy.</p>\n<h2 id=\"h_01HGBKADY77YM5M6NRBDJWKA7H\">\n<span class=\"wysiwyg-font-size-large\"><strong>III. Eligibility</strong></span> <span class=\"wysiwyg-font-size-large\"><strong>Requirements</strong></span>\n</h2>\n<p>You agree that you will not under any circumstances:</p>\n<ul>\n<li>Cause harm to us, our customers or others;</li>\n<li><span style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;\">Be a resident of, or make your Submission from, a country or region against which the United States has issued export sanctions or other trade restrictions (e.g., Cuba, Iran, North Korea, Sudan, Syria and Crimea);</span></li>\n<li><span style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;\">Be listed on the U.S. Department of the Treasury’s Specially Designated Nationals List;</span></li>\n<li><span style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;\">Be in violation of any national, state, or local law or regulation;</span></li>\n<li><span style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;\">Compromise our privacy or safety or the privacy or safety of our customers (including their customers) and our operation or the operation of our customers’ services;</span></li>\n<li><span style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;\">Store, share, compromise or destroy our or our customers’ data; or</span></li>\n<li><span style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;\">Be less than 14 years of age. If you are at least 14 years old, but are considered a minor in your place of residence, you must get your parent’s or legal guardian’s permission prior to participating in the program.</span></li>\n</ul>\n<p>If we discover that you do not meet any of the criteria above, we will remove you from the ResponsibleDisclosure.com Disclosure Program. Any submissions you make to ResponsibleDisclosure.com, whether via your ResponsibleDisclosure.com account or via email shall be considered “Submission(s)” for purposes of these Terms of Use.</p>\n<h2 id=\"h_01HGBKDXT7TZ4NW7H7RPN7W0DP\"><span class=\"wysiwyg-font-size-large\"><strong>IV. Posting and Conduct Restrictions</strong></span></h2>\n<p>By transmitting any Submission while using the Site, you agree, represent and warrant as follows:</p>\n<ul>\n<li>You are solely responsible for your account and the activity that occurs while signed in to or while using your account;</li>\n<li>You will not transmit content that is copyrighted or subject to third party proprietary rights, including privacy, publicity, trade secret, etc., unless you are the owner of such rights or have the appropriate permission from their rightful owner to specifically submit such content to us; and</li>\n<li>You hereby affirm we have the right to determine whether any of your Submissions are appropriate and comply with these Terms of Use, remove any and/or all of your communications, and terminate your account with or without prior notice.</li>\n<li><span style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;\">You will not send unsolicited bulk communications, interfere or attempt to interfere with the proper functioning our or our customers’ websites and systems, and will not publish or link to malicious content intended to damage or disrupt another user’s browser or computer; and</span></li>\n<li><span style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;\">You will not take any action that we deem to impose or to potentially impose an unreasonable or disproportionately large load on our or our customers’ servers or network infrastructure.</span></li>\n</ul>\n<p><strong><span class=\"wysiwyg-font-size-large\">V. Access Limitation; Appropriate Action</span></strong></p>\n<p>We reserve the right, but are not obligated, to limit or deny access to the Site and to take other appropriate action if a user violates these Terms of Use or engages in any activity that violates the rights of any person or entity or which we deem unlawful, offensive, abusive, harmful or malicious.</p>\n<p><strong><span class=\"wysiwyg-font-size-large\">VI. License Grant</span></strong></p>\n<p>By transmitting your submission to ResponsibleDisclosure.com, you perpetually allow us and our affiliates and subsidiaries the unconditional ability to use, modify, create derivative work from, distribute, disclose and store the information provided in your report or to have others do the same on our behalf, and these rights cannot be revoked. You represent that the report is original to you and that you own all right, title and interest in the submission.</p>\n<p><strong><span class=\"wysiwyg-font-size-large\">VII. Intellectual Property</span></strong></p>\n<p>You acknowledge and agree that we and our licensors retain ownership of all intellectual property rights of any kind related to the Site, including applicable copyrights, trademarks and other proprietary rights. Other product and company names that are mentioned on the Site may be trademarks of their respective owners. We reserve all rights that are not expressly granted to you in the Terms of Use.</p>\n<p><strong><span class=\"wysiwyg-font-size-large\">VIII. Disclaimer; Limitation of Damages; Release</span></strong></p>\n<p>OUR SITE IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, SECURITY, ACCURACY AND NON-INFRINGEMENT. WITHOUT LIMITING THE FOREGOING, WE MAKE NO WARRANTY OR REPRESENTATION THAT ACCESS TO OR OPERATION OF THE SITE WILL BE UNINTERRUPTED OR ERROR FREE. YOU ASSUME FULL RESPONSIBILITY AND RISK OF LOSS RESULTING FROM YOUR DOWNLOADING AND/OR USE OF FILES, INFORMATION, CONTENT OR OTHER MATERIAL OBTAINED FROM THE SITE. TO THE EXTENT PERMITTED BY LAW, IN NO EVENT SHALL WE, OUR AFFILIATES, DIRECTORS, EMPLOYEES OR ITS LICENSORS OR PARTNERS BE LIABLE FOR ANY DIRECT, INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR EXEMPLARY DAMAGES, INCLUDING WITHOUT LIMITATION DAMAGES FOR LOSS OF PROFITS, GOODWILL, USE, DATA OR OTHER INTANGIBLE LOSSES, THAT RESULT FROM (A) THE USE, DISCLOSURE, OR DISPLAY OF YOUR INFORMATION OR CONTENT; (B) YOUR USE OR INABILITY TO USE THE SITE; (C) THE SITE GENERALLY OR THE SOFTWARE OR SYSTEMS THAT MAKE THE SITE AVAILABLE; OR (D) ANY OTHER INTERACTIONS WITH THE SITE OR ANY OTHER USER OF THE SITE, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE) OR ANY OTHER LEGAL THEORY, WHETHER OR NOT WE HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGE, AND EVEN IF A REMEDY SET FORTH HEREIN IS FOUND TO HAVE FAILED OF ITS ESSENTIAL PURPOSE.</p>\n<p><strong><span class=\"wysiwyg-font-size-large\">IX. Confidentiality</span></strong></p>\n<p>Any information you receive or collect about us or any of our customers through the ResponsibleDisclosure.com Disclosure Program (“Confidential Information”) must be kept confidential and only used in connection with the ResponsibleDisclosure.com Disclosure Program. You may not use, disclose or distribute any such Confidential Information, including, but not limited to, any information regarding your Submission and information you obtain when researching the sites of our customers, without our prior written consent.</p>\n<p><strong><span class=\"wysiwyg-font-size-large\">X. Indemnity</span></strong></p>\n<p>You agree to defend, indemnify and hold harmless us, our parent company, officers, directors, employees and agents, from and against any and all claims, damages, obligations, losses, liabilities, costs or debt, and expenses (including but not limited to reasonable attorney’s fees) arising from: (i) your use of and access to the Site; (ii) your violation of any term of these Terms of Use; (iii) your violation of any third party right, including without limitation any copyright, property, or privacy right; or (iv) any claim that any content submitted by you causes damage to a third party. This defense and indemnification obligation will survive these Terms of Use and your use of ResponsibleDisclosure.com.</p>\n<p><strong><span class=\"wysiwyg-font-size-large\">XI. Modifications of Terms of Use</span></strong></p>\n<p>We can amend these Terms of Use at any time and will update these Terms of Use in the event of any such amendments. It is your sole responsibility to check the Site from time to time to view any such changes. If you continue to access or use the Site, you signify your agreement to our revisions to these Terms of Use.</p>\n<p><strong><span class=\"wysiwyg-font-size-large\">XII. Applicable Laws; Venue</span></strong></p>\n<p>These Terms of Use and your use of the Site are governed by the federal laws of the United States of America and the laws of the State of California. Any action related to this Site will be filed only in the appropriate state or federal court located within San Mateo County, California. By using this Site, you signify your consent to the jurisdiction of the state and/or federal courts located with San Mateo County, California.</p>\n<p><strong><span class=\"wysiwyg-font-size-large\">XIII. Suggestions and Feedback</span></strong></p>\n<p>We welcome your feedback and inquiries. If you have any comments or questions, please contact us by sending an email to support@synack.com.</p>","user_segment_ids":[]},{"id":23491597359507,"url":"https://bprd.zendesk.com/api/v2/help_center/en-us/articles/23491597359507.json","html_url":"https://bp.responsibledisclosure.com/hc/en-us/articles/23491597359507-Scope-and-ROE","author_id":10283501135507,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":23490493200019,"created_at":"2023-11-28T18:29:18Z","updated_at":"2024-07-26T07:19:48Z","name":"Scope and ROE","title":"Scope and ROE","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2024-07-26T07:19:47Z","user_segment_id":null,"permission_group_id":1709674,"content_tag_ids":[],"label_names":[],"body":"<h2 id=\"h_01HGBJCRK6S0ATK8NTPJNYBVKH\"><strong>Scope</strong></h2>\n<p>The following BP web applications are in scope:</p>\n<ul>\n<li>*.bp.com</li>\n</ul>\n<h2 id=\"h_01HGBJEQ2SY8APSBG0W9824TGY\"><strong>Rules of Engagement</strong></h2>\n<ul>\n<li>No Denial of Service testing</li>\n<li>No Physical or Social Engineering</li>\n<li>No testing of Third-party Services</li>\n<li>No uploading of any vulnerability or client-related content to third-party utilities (e.g. Github, DropBox, YouTube)</li>\n<li>All attack payload data must use professional language</li>\n<li>If able to gain access to a system, accounts, users, or user data, stop at the point of recognition and report. Do not dive deeper to determine how much more is accessible.</li>\n<li>When documenting a vulnerability, if a vulnerability is public, please make sure it is discreet and doesn't identify the client.</li>\n</ul>\n<h2 id=\"h_01HGBJKX9EKG6XYY70BNQQ7SE8\"><strong>Low Impact Vulnerabilities - Out of Scope</strong></h2>\n<p>The following vulnerabilities are considered too low of an impact to the client and would be marked as Out of Scope if submitted:</p>\n<ul>\n<li>Google Maps API Keys</li>\n<li>Account/e-mail enumeration using brute-force attacks</li>\n<li>Valid user account/email enumeration not requiring brute-force will be considered</li>\n<li>Any low impact issues related to session management (i.e. concurrent sessions, session expiration, password reset/change log out, etc.)</li>\n<li>Bypassing content restrictions in uploading a file without proving the file was received</li>\n<li>Clickjacking/UI redressing</li>\n<li>Client-side application/browser autocomplete or saved password/credentials</li>\n<li>Descriptive or verbose error pages without proof of exploitability or obtaining sensitive information</li>\n<li>Directory structure enumeration (unless the fact reveals exceptionally useful information)</li>\n<li>Incomplete or missing SPF/DMARC/DKIM records</li>\n<li>Issues related to password/credential strength, length, lockouts, or lack of brute-force/rate limiting protections\n<ul>\n<li>Account compromises (especially admin) as a result of these issues will likely be considered VALID</li>\n</ul>\n</li>\n<li>Lack of SSL or Mixed content\n<ul>\n<li>Leaking Session Cookies, User Credentials, or other sensitive data will be reviewed on a case by case basis</li>\n<li>If leaking of sensitive data requires MiTM positioning to exploit, it will be considered out of scope</li>\n</ul>\n</li>\n<li>Login/Logout/Unauthenticated/Low-impact CSRF\n<ul>\n<li>CSRF Vulnerabilities may be acceptable if they are of higher impact. Examples of low impact CSRF include: Add/Delete from Cart, Add/remove wishlist/favorites, Nonsevere preference options, etc.</li>\n</ul>\n</li>\n<li>Low impact Information disclosures (including Software version disclosure)</li>\n<li>Missing Cookie flags</li>\n<li>Missing/Enabled HTTP Headers/Methods which do not lead directly to a security vulnerability</li>\n<li>Reflected file download attacks (RFD)</li>\n<li>Self-exploitation (i.e. password reset links or cookie reuse)</li>\n<li>SSL/TLS best practices that do not contain a fully functional proof of concept</li>\n<li>URL/Open Redirection</li>\n<li>Use of a known-vulnerable library which leads to a low-impact vulnerability (i.e. jQuery outdated version leads to low impact XSS)</li>\n<li>Valid bugs or best practice issues that are not directly related to the security posture of the client</li>\n<li>Vulnerabilities affecting users of outdated browsers, plugins or platforms</li>\n<li>Vulnerabilities that allow for the injection of arbitrary text without allowing for hyperlinks, HTML, or JavaScript code to be injected</li>\n<li>Vulnerabilities that require the user/victim to perform extremely unlikely actions (i.e. Self-XSS)\n<ul>\n<li>Self-XSS for a Persistent/Stored XSS will be considered. The only circumstances under which we will not require proof of impact to multiple users is for Persistent/Stored XSS in cases where only one set of credentials is available to the researcher and other users cannot be tested. We will require documentation or evidence reasonably proving the functionality is available to other users/backend team/admin for the report to be considered.</li>\n<li>Any type of XSS that requires a victim to press an unlikely key combination is NOT in scope (i.e. alt+shift+x for payload execution)</li>\n</ul>\n</li>\n<li>Code repository reports are out of scope, unless they:\n<ul>\n<li>Contain publicly accessible IP/Domains (not rfc1918, nonpublic, or otherwise inaccessible)</li>\n<li>Commits dated within the last year</li>\n<li>Have a demonstrable impact</li>\n</ul>\n</li>\n</ul>\n<p>Additional specific vulnerability types considered out of scope due to low impact:</p>\n<ul>\n<li>IIS Tilde File and Directory Disclosure</li>\n<li>SSH Username Enumeration</li>\n<li>Wordpress Username Enumeration</li>\n<li>SSL Weak Ciphers/ POODLE / Heartbleed\n<ul>\n<li><span style=\"font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;\">Heartbleed vulnerabilities may be acceptable if proof is provided that sensitive information can be disclosed</span></li>\n</ul>\n</li>\n<li>CSV Injection</li>\n<li>PHP Info</li>\n<li>Server-Status if it does not reveal sensitive information</li>\n<li>Snoop Info Disclosures</li>\n</ul>","user_segment_ids":[]},{"id":23490974049811,"url":"https://bprd.zendesk.com/api/v2/help_center/en-us/articles/23490974049811.json","html_url":"https://bp.responsibledisclosure.com/hc/en-us/articles/23490974049811-Acknowledgments","author_id":10283501135507,"comments_disabled":true,"draft":false,"promoted":false,"position":0,"vote_sum":0,"vote_count":0,"section_id":23487428191891,"created_at":"2023-11-28T18:15:49Z","updated_at":"2026-09-16T16:38:35Z","name":"Acknowledgments","title":"Acknowledgments","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2026-09-16T16:38:35Z","user_segment_id":null,"permission_group_id":1709674,"content_tag_ids":[],"label_names":[],"body":"<p>Below is a list of researchers that have responsibly disclosed valid vulnerabilities to BP:</p><p> </p><p> </p><figure class=\"wysiwyg-table wysiwyg-table-align-left\" style=\"width: 100%;\"><table style=\"border-collapse: collapse;\"><tbody>\n<tr>\n<td style=\"width: 33.3333%;\"><strong>Name</strong></td>\n<td style=\"width: 33.3333%;\"><strong>Profile</strong></td>\n<td style=\"width: 33.3333%;\"> </td>\n</tr>\n<tr>\n<td>Muhammad Fitri Bin Mohd Sultan</td>\n<td>linkedin.com/in/ftrisultan</td>\n<td>fitrisultan.my</td>\n</tr>\n<tr>\n<td style=\"width: 33.3333%;\">Buğrahan Karahan</td>\n<td style=\"width: 33.3333%;\">tr.linkedin.com/in/bu%C4%9Frahan-karahan-ba9592198</td>\n<td style=\"width: 33.3333%;\"> </td>\n</tr>\n<tr>\n<td>Ahmad Khan</td>\n<td> </td>\n<td> </td>\n</tr>\n<tr>\n<td><p data-local-id=\"c67eefa66a2d\" data-prosemirror-content-type=\"node\" data-prosemirror-node-name=\"paragraph\" data-prosemirror-node-block=\"true\" data-pm-slice=\"1 1 []\">Alex Schapiro</p></td>\n<td> </td>\n<td> </td>\n</tr>\n</tbody></table></figure>","user_segment_ids":[]}],"sort_by":"position","sort_order":"asc"}