Vulnerability Disclosure Policy

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct, and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will make it known that your actions were conducted in compliance with this policy.

Translated reserves all legal rights in the event of noncompliance with this policy.

Program Eligibility

To be eligible to participate in our Bug Bounty Program, you must:

• Not be a resident of, or make Submissions from, a country against which the EU has issued export sanctions or other trade restrictions.
• Not be excluded by the program for past unfair behaviours

If you

• do not meet the eligibility requirements above;
• breach any of these Program Terms or any other agreements you have with Translated;
• or we determine that your participation in the Bug Bounty Program could adversely one of our stakeholders or the business continuity.

We, in our sole discretion, may remove you from the Bug Bounty Program and disqualify you from receiving any benefit of the Bug Bounty Program.

Disclosure policy

Any data you receive, obtain access to or collect about Translated or any Translated stakeholder is considered Translated’s confidential information ("Confidential Information").

Confidential Information must be kept confidential and only used to provide Translated information in relation to the submitted report.

No further use or exploitation of Confidential Information is allowed. You will permanently erase all Confidential Information for any systems and devices after (rewarded or not) th of the submission of the report.

You may not use, or disclose the information related to the report, without our prior explicit consent.

Please note, not all requests for public disclosure will be approved.

Any unauthorized public disclosure will result in a program ban and, obviously, in not eligible for any reward.

Please review HackerOne's disclosure guidelines for general best practices. For any reports submitted to Translated, this policy supersedes any conflicting HackerOne policies.

Triage

Let us know as soon as possible upon discovery of a potential security issue. All the reports submitted will be triaged within 90 working days from the date of submission.

Please, do not solicit responses even after this timeframe expires. We are strongly committed to evaluate and fix vulnerabilities but it could happen that the general workload and different priorities force us to delay the triage.
We think that that the timeslot allocated for this activity must be dedicated to the handling of the reports and not to updates related to resolution times.
Thank you for your understanding.

Avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own.

Let us identify you

Please include a header

X-EthicalHacker: < your_email >

when you test so we can identify your requests easily.

If you create a customer account for your test, please, use Ethical as your first name and Hacker as your last name, and provide your email address

Rules

Please do:

• respect privacy & make a good faith effort not to access, process, or destroy personal data
• be patient and provide us with clarifications to any questions we may have about your report
• be respectful and kind when interacting with our team, and our team will do the same
• use accounts that are your own. We expect your report to clearly reference your email address
• when testing put all your effort into avoiding negative impact on data and, in general, business continuity
• if you are unsure, please, stop. If you think you may cause, or have caused, damage by testing a vulnerability, report your initial finding(s) and request authorization to continue testing

Please DON’T

• do not brute force credentials or guess credentials to gain access to systems
• do not participate in denial of service or spam attacks
• do not use vulnerability testing tools that generate a significant volume of traffic
• do not upload shells or create a backdoor of any kind
• do not publicly disclose a Vulnerability without our explicit review and consent
• do not engage in any form of social engineering of our employees, customers, or partners
• do not attempt to extract, download, or otherwise exfiltrate data other than your own
• do not change passwords of (and, in general, do not interact with) any account that is not yours. If ever prompted to change a password of an account you did not register yourself, stop and report the finding immediately
• do not do anything that would be considered a privacy violation, cause destruction of data, or interrupt or degrade our service.

Rewards

All reports submitted in accordance with the rules and scope outlined above and that result in a change of code or configuration are eligible for bounties, ranging from $50 to $1000, depending on the severity of the issue.

We may pay higher rewards for unusually clever or severe vulnerabilities or pay lower rewards for vulnerabilities that require unusual user interaction.

We may also decide a single report actually constitutes multiple bugs or that multiple reports are so closely related that they only warrant a single reward.

You trust the Translated team when the report is rejected because it constitutes an already reported issue. Translated will be not obliged to provide any proof in these cases.

Translated rewards bug bounty hunters on a first-come, first-served basis - the first comprehensive report for the same bug will be awarded any bounty. You trust that Translated will act in a fair way in managing the queue.

The amount of the reward is totally up to the Translated team and is not negotiable in any way.

Legal

We are unable to issue rewards to individuals who are on sanctions lists, or who are in countries (e.g. Cuba, Iran, North Korea, Sudan, Syria, Russia) on sanctions lists. You are responsible for any tax implications depending on your country of residency and citizenship. There may be additional restrictions on your ability to enter depending upon your local law.

Of course, your testing must not violate any law, or disrupt or compromise any data that is not your own.

By making a Submission, you give us the right to use your Submission for any purpose.

This is not a competition, but rather an experimental and discretionary rewards program. You should understand that we can cancel the program at any time and the decision as to whether or not to pay a reward has to be entirely at our discretion.

Translated rewards bug bounty hunters on a first come, first served basis so if you find a vulnerability that has just been reported we will not reward you.

Modifications

Please check this site regularly as we routinely update our program terms and eligibility. Modifications are effective upon posting.