Snapshot 256
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to main content Overview Honeycomb welcomes responsible disclosure of security vulnerabilities. This page covers the core terms of our bug bounty program. Where the circumstances require interpretation or judgment, we apply our discretion based on the situation and your conduct. In scope This program covers security vulnerabilities affecting services provided by us at ui.honeycomb.io and api.honeycomb.io, including: Web application vulnerabilities, such as XSS, CSRF, SQLi Authentication issues Authorization issues Remote code execution Out of scope The following are not covered by this program, regardless of any in-scope coverage indicated above: Any issues related to www.honeycomb.io, docs.honeycomb.io, or info.honeycomb.io Social engineering Out-of-date browsers and plugins Vulnerabilities in third-party applications that don’t directly affect Honeycomb’s data or services Issues already known to us or previously reported by others Issues we’ve determined to be of acceptable risk Ineligible activities The following activities are out of scope, ineligible for a reward, and may result in an IP ban from our services and removal from the program: Denial of service (DoS) attacks, or any action that generates excessive traffic Testing rate limiting Using automated tooling in a way that generates excessive traffic Spam of any kind Engaging with our support team as part of your report Non-qualifying vulnerabilities We don’t award rewards for vulnerabilities that are trivial or broadly applicable across services, including: Lack of password length restrictions Demonstrating that a page can be iFramed without identifying a clickjackable link on that page Self-XSS Vulnerabilities that require privileged access to the victim’s device, such as a rooted phone User existence or enumeration vulnerabilities Password complexity requirements Insecure cookie settings for non-sensitive cookies Bugs that require highly unlikely user interaction to exploit Reports from automated tools or scans without an accompanying demonstration of exploitability Text-only injection in error pages Automatic hyperlink construction by third-party email providers Using email mutations (+, ., etc.) to create multiple accounts from a single email address Researcher responsibilities We work with researchers who follow responsible disclosure practices. To participate, you must: Allow us reasonable time to investigate and mitigate an issue before disclosing or sharing it with others. Not interact with other users or accounts without their explicit, informed consent. Avoid all privacy violations and any disruption of service to other users and accounts. Not exploit any security risk you discover, including through additional demonstrations of the same risk. Comply with all applicable laws and regulations. Submit reports that clearly demonstrate applicability to Honeycomb’s tools, systems, or infrastructure. Provide your real name, proof of identity if requested, and a non-cash payment method. Submitting a report Send your report to security@honeycomb.io. Reports submitted via BCC, or bundling multiple vulnerabilities into a single email, are not accepted. Include the substance of your report directly in your email body. We don’t accept reports that provide vulnerability details in a PDF or other attached document. Attach only supporting evidence, such as screenshots or screen recordings. Rewards All rewards are at our discretion. We aim to align reward amounts with the severity of the reported vulnerability and appreciate the time and effort responsible researchers invest.