Retention Science from Constant Contact (Retention Science) takes the security of our platforms and our users’ data very seriously. If you have discovered or believe you have discovered potential security vulnerabilities in a Retention Science service, we encourage you to disclose your discovery to us as quickly as possible in accordance with this Vulnerability Disclosure Program. Please note that the Vulnerability Disclosure Program is different from a bug bounty. The Vulnerability Disclosure Program allows ethical hackers to find and report vulnerabilities but it does not provide monetary compensation. Retention Science reserves the right to accept or reject any submission.

Safe Harbor

If you discover and report security vulnerabilities in accordance with this [Vulnerability Disclosure Program], we consider this research to be:

• Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this Voluntary Disclosure Policy;

• Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;

• Exempt from restrictions in our Terms of Service that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this [Vulnerability Disclosure Program]; and

• Lawful, helpful to the overall security of the Internet, and conducted in good faith.

You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this [Vulnerability Disclosure Program], please contact us before going any further.

Eligibility

You may not participate in this program if you are an employee or family member of an employee, or a current vendor or employee of such vendor, of Retention Science from Constant Contact of any of its subsidiaries. You are also prohibited from participating if you are (i) in a country or territory that is the target of U.S. sanctions (including Cuba, Iran, Syria, North Korea, or the Crimea region of Ukraine), (ii) designated as a Specially Designated National or Blocked Person by the U.S. Department of the Treasury’s Office of Foreign Assets Control or otherwise owned, controlled, or acting on behalf of such a person or entity, or (iii) otherwise a prohibited party under U.S. trade and export control laws. 

Discretionary Disclosure Policy:

Because public disclosure of a security vulnerability could put the entire Retention Science from Constant Contact community at risk, we require that you keep such potential vulnerabilities confidential until we are able to address them. Therefore, public disclosure of the submission details of any identified or alleged vulnerability without express written consent from Retention Science from Constant Contact will deem the submission as noncompliant with this Vulnerability Disclosure Policy. 

Discovering Security Vulnerabilities

We encourage responsible security research on the Retention Science from Constant Contact services and products. We allow you to conduct vulnerability research and testing on the Retention Science from Constant Contact services and products to which you have authorized access. In no event shall your research and testing involve, without limitation:

• Accessing, or attempting to access, accounts or data that do not belong to you or your authorized users,

• Any attempt to download, modify, or destroy any data,

• Executing, or attempting to execute, a denial of service attack,

• Sending, or attempting to send, unsolicited or unauthorized email, spam or other forms of unsolicited messages,

• Testing third party websites, applications or services that integrate with any Retention Science from Constant Contact services,

• Posting, transmitting, uploading, linking to, sending or storing malware, viruses or similar harmful software, or otherwise attempting to interrupt or degrade the Constant Contact services.

• Any activity that violates any applicable law.

Reporting In-Scope Security Vulnerabilities

If you believe you have discovered a security vulnerability issue, please share the details with Retention Science from Constant Contact by completing our Submission Form. We will work with you to validate and respond to security vulnerabilities that you report to us. Your report will be forwarded to our partner (BugCrowd) for timely acknowledgement and verification. You are rewarded “points” for each validly accepted report made. You must be the first person to report the bug to earn all possible points.Please do not send vulnerability emails directly to Retention Science from Constant Contact employees. Verified issues will be passed to our development teams for remediation on a timeline commensurate with the severity of the issue (as defined by the BugCrowd Vulnerability Rating Taxonomy). {https://bugcrowd.com/vulnerability-rating-taxonomy}Email communication between you and Retention Science from Constant Contact, including without limitation, emails you send to Constant Contact reporting a potential security vulnerability, should not contain any of your proprietary information. The contents of all email communication you send to Constant Contact shall be considered non-proprietary. Retention Science from Constant Contact, or any of its affiliates, may use such communication or material for any purpose whatsoever, including, but not limited to, reproduction, disclosure, transmission, publication, broadcast, and further posting.

Out-of-Scope 

The following is a partial list of issues that we ask for you not to report, unless you believe there is an actual vulnerability:

• CSRF on forms that are available to anonymous users

• Disclosure of known public files or directories (e.g. robots.txt)

• Domain Name System Security Extensions (DNSSEC) configuration suggestions

• Banner disclosure on common/public services

• HTTP/HTTPS/SSL/TLS security header configuration suggestions

• Lack of Secure/HTTPOnly flags on non-sensitive cookies

• Logout Cross-Site Request Forgery (logout CSRF)

• Phishing or Social Engineering Techniques

• Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality

• Sender Policy Framework (SPF) configuration and Domain-based Message Authentication, Reporting & Conformance (DMARC) suggestions

By participating in this Vulnerability Disclosure Program, you acknowledge that you have read and agree to Retention Science from Constant Contact’s Terms of Service and Privacy Notice, as well as BugCrowd’s Standard Disclosure Terms. In the event of any conflict between Retention Science from Constant Contact’s Terms of Service and BugCrowd’s Standard Disclosure Terms, Constant Contact’s Terms of Service shall control.