Responsible Disclosure Program

At Swoogo, we strive to build high quality, reliable, and secure software that brings a high degree of value to our customers and strive to do so with efficiency and creativity. We value and welcome ethical hackers to find and report vulnerabilities to us. Our Responsible Disclosure Program (“RDP”) guidelines are listed below.

Table of Contents

Program Terms
General Guidelines
Vulnerability Submissions
Ownership of Submissions
Confidentiality
Indemnification
Changes to Program Terms
Thanks!
PGP Key

Program Terms

Please note that your participation in the RDP is voluntary and subject to the terms and conditions set forth in this document (“Program Terms”). By submitting a site or product vulnerability (each, a “Submission”) to Swoogo, LLC (“Swoogo”) you acknowledge that you have read and agreed to these Program Terms.

These Program Terms supplement the terms of the Swoogo Event Cloud Order Form, the Swoogo Privacy Policy, and any other agreement in which you have entered with Swoogo (collectively “Swoogo Agreements”). The terms of those Swoogo Agreements will apply to your use of, and participation in, the RDP as if fully set forth herein. If any inconsistency exists between the terms of the Swoogo Agreements and these Program Terms, these Program Terms will control, but only with regard to the RDP.

To encourage responsible disclosures, Swoogo commits that, if we conclude, in our sole discretion, that a disclosure respects and meets all the guidelines of these Program Terms and the Swoogo Agreements, Swoogo will not bring a private action against you or refer a matter for public inquiry.

As part of your research, do not modify any files or data, including permissions, and do not intentionally view or access any data beyond what is needed to prove the vulnerability.

Disclosure Guidelines

By providing a Submission or agreeing to the Program Terms, You agree that you may not publicly disclose your findings or the contents of your Submission to any third parties in any way without Swoogo’s prior written approval.

General Guidelines

You may not commit any privacy violation, degradation, or disruption to the availability of our production systems during your testing.
You may not attempt to brute-force or spam our systems.
If the identified vulnerability can potentially extract information about our customers or systems, or impair our systems’ ability to function normally, then you must refrain from actually exploiting such a vulnerability. This is necessary for us to consider your disclosure a responsible one.
You must keep your disclosure confidential between yourself and Swoogo until we resolve the issue.
We will undertake reasonable efforts to confirm and fix issues promptly.

Vulnerability Submissions

Please report any security issues you find to [email protected]. If your submission contains any sensitive vulnerability information, please encrypt it using our PGP public key at the bottom of this page.

Please include the following in your submission:

Your name and contact information.
Company name (if applicable).
A detailed description of the potential vulnerability.
Exact steps to reproduce the issue, including any associated URL and parameters demonstrating the vulnerability.
The relevant details of your system’s configuration, such as any browser or user-agent information and operating system version.
Your IP address and Swoogo account or event registration, so we can coordinate your activity with our logs.

Ownership of Submissions

As a condition of participation in the Swoogo RDP, you hereby grant Swoogo, its subsidiaries, affiliates and customers a perpetual, irrevocable, worldwide, royalty-free, transferrable, sublicensable (through multiple tiers) and exclusive license to use, reproduce, adapt, modify, publish, distribute, publicly perform, create derivative works from, make, use, sell, offer for sale and import the Submission, as well as any materials submitted to Swoogo in connection therewith, for any purpose. You should not send us any Submission that you do not agree to license to us. You hereby represent and warrant that the Submission is original to you and you own all right, title and interest in and to the Submission. Further, you hereby waive all other claims of any nature, including express contract, implied-in-fact contract, or quasi-contract, arising out of any disclosure of the Submission to Swoogo. In no event shall Swoogo be precluded from discussing, reviewing, developing for itself, having developed, or developing for third parties, materials that are competitive with those set forth in the Submission irrespective of their similarity to the information in the Submission, so long as Swoogo complies with the terms of participation stated herein.

Confidentiality

Any information you receive or collect about Swoogo or any Swoogo user through the RDP (“Confidential Information”) must be kept confidential and only used in connection with the RDP. You may not use, disclose or distribute without Swoogo’s prior, written consent any such Confidential Information, including, but not limited to, any information regarding your Submission and information you obtain when researching the Swoogo sites.

Indemnification

In addition to any indemnification obligations you may have under the Swoogo Agreements, you agree to defend, indemnify and hold Swoogo and its subsidiaries and affiliates, and its and our officers, directors, agents, joint ventures, employees, and suppliers (each, an “Indemnified Party”), harmless from any claim or demand (including attorneys’ fees) made or incurred by an Indemnified Party and/or any third party due to or arising out of your Submissions, your breach of these Program Terms, and/or your improper use of the RDP.

Changes to Program Terms

The RDP, including its policies, is subject to change or cancellation by Swoogo at any time, without notice. As such, Swoogo may amend these Program Terms and/or its policies at any time by posting a revised version on our website. By continuing to participate in the RDP after Swoogo posts any such changes, you accept the Program Terms, as modified.

Thanks!

We really appreciate you working with us to responsibly submit a disclosure and working with us to improve our security. We recognize the work and talent you’ve put into finding these issues and thank you for reaching out to us.

Our PGP Key

If you are submitting sensitive vulnerability information or wish to communicate with us privately about your concern, please use the following PGP key to encrypt your message to [email protected].