STAY22 BUG BOUNTY PROGRAM TERMS

The Stay22 Bug Bounty Program Terms (“Terms”) cover your participation in the Stay22 Bug Bounty Program (the “Program”). Your participation in the Program is voluntary and subject to these Terms between you and Stay22 Technologies Inc. (“Stay22”, “we”, “us”, “our”). These Terms, together with any other terms that are expressly incorporated by reference therein, constitute a legal agreement entered between you and Stay22.

BY SUBMITTING A SITE, PRODUCT OR SYSTEM VULNERABILITY TO STAY22, IN ANY FORMAT: (A) YOU ACCEPT AND AGREE TO BE BOUND AND COMPLY WITH THESE TERMS; AND (B) YOU REPRESENT AND WARRANT THAT YOU HAVE REACHED THE LEGAL AGE OF MAJORITY UNDER APPLICABLE LAW TO FORM A BINDING CONTRACT WITH US.

IF YOU ARE SUBMITTING A VULNERABILITY ON BEHALF OF AN ENTITY, YOU REPRESENT AND WARRANT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ENTITY TO THIS AGREEMENT.

Program Overview

Stay22 recognizes the value of the security research community, and its contributions towards improving the security posture of our platforms. The following Terms ensure our ability to collaborate with the security research community in a structured and formal process, defining clear expectations, terms, conditions, and boundaries.

Changes to these Terms

Except where prohibited by applicable law, we reserve the right, at our discretion, to amend any element of these Terms, at any time by posting an amended version of these Terms to our website. If you do not agree to the amended version of these Terms, you must stop participating in the Program. Otherwise, your continued participation in the Program indicates your acceptance of the amended Terms.

Program and Reward Eligibility

To participate in the Program, you must NOT be:

• An employee of Stay22 or its affiliates, or an immediate family member of a person employed by Stay22 or its affiliates. This includes former employees.
• Less than 18 years of age.
• In violation of any level of regulation or law, be it state, provincial, federal or any other.

You will be eligible to receive a bounty reward under the following conditions: (i) you are the first researcher to submit the vulnerability; (ii) the vulnerability is deemed to be valid by the Stay22 security team; and (iii) you are in compliance with these Terms and any other Program guidelines or terms that may be provided by Stay22 from time to time.

Notwithstanding the foregoing:

• Stay22 reserves the right, at its discretion, to disqualify or exclude, as appropriate, any participant from the Program immediately and without prior notice, including if such participant presents a security risk to Stay22, its affiliates, partners or users; or breaches these Terms or any applicable laws and regulations. Any participant who is disqualified or excluded shall have no claim against Stay22 arising from such disqualification. Stay22’s decision regarding disqualification, or exclusion, shall be final and binding.
• Stay22 makes the final call on whether a vulnerability submitted is eligible for a reward and to set the payout based on our Reward Structure.
• Stay22 may revise the validity or severity of submitted vulnerabilities based on internal assessment carried out by the Stay22 security team.
• Stay22 may deem a vulnerability report ineligible for a reward if it fails to meet the standard and format laid out in our Report Requirements (below).

Testing and Report Requirements

• All reports must follow the format in the provided MD template for them to be processed by the Stay22 security team: https://www.stay22.com/bugbountytemplate.md
• Test account creation must always use an AID with the prefix "bug-bounty", i.e a valid AID for testing would be "bug-bounty-security-test".
• When creating a test account, always select the 0-5K range for visitors/traffic.
• Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
• When multiple vulnerabilities share a root cause, they should be aggregated under a single report, and will be triaged and validated as a single vulnerability.
• Test accounts and test data created during vulnerability research should be carefully documented so proper clean up can be carried out once the Program process is complete.
• All testing activity should be labeled using the custom header stay22-bug-bounty: username where username is the email address corresponding with your submission.
• All submissions should be addressed to [security@stay22.com](mailto:security@stay22.com) using the following format for the subject: `[SEVERITY][VULNERABILITY TITLE][CVSS SCORE].

Prohibited Actions

• Social engineering attacks are strictly forbidden.
• Security testing and research must avoid modification of files or data whenever possible.
• You must not attempt to access, copy, or modify any real user data, including for personal information, unless it is strictly necessary to demonstrate a vulnerability. Where access to user data is unavoidable, you must minimize such access to the greatest extent possible and must not retain, store, or disclose any such data beyond what is required for the vulnerability report. 

   

Safe Harbor:

• Security testing activities (including research) carried out in Good Faith and in compliance with these Terms will be considered “Authorized Activity” under the Program. “Good Faith” means any activity carried out solely for purposes of good-faith testing, investigation, and/or correction of a security flaw or vulnerability, where such activity is carried out in a manner designed to avoid any harm to individuals or the public, and where the information derived from the activity is used primarily to promote the security or safety of the class of devices, machines, or online services to which the accessed computer belongs, or those who use such devices, machines, or online services. For Authorized Activity carried out under the Program, Stay22 will not to initiate or pursue any legal action, claim, or proceeding against you, nor will we report you to the authorities or support any third party in bringing legal action against you for such Authorized Activity.
• Stay22 cannot and does not authorize testing activity against third party infrastructure, and therefore third parties are not bound by these Safe Harbor terms. This means you should be especially careful when carrying out disruptive testing that could have potential impact on shared infrastructure owned and managed by third parties as they may bring legal action against you at their own discretion.

Scope Inclusions

The following targets are included in the program scope:

• *.stay22.com domain and subdomains

Scope Exclusions

The following targets are explicitly excluded from the program scope, whenever there may be a conflict between the list of inclusions and exclusions, entries subject to the list of exclusions prevail:

• Any 3rd party integrations to our web clients residing on domains outside of stay22.com.
• Any subdomain that redirects to 3rd party platforms not managed by Stay22.

We follow industry standards to ensure our bug bounty program is valuable for Stay22 and security researchers alike. The following vulnerability categories are explicitly excluded from the program scope and will not be processed:

• Vulnerabilities that do not take place within a sensitive context or within an authenticated session, or pose no impact, for example:
• Clickjacking without severe user implications
• CSRF on requests which are not privileged
• Software version disclosure, even when outdated
• Stack traces, error messages, or other forms of information disclosure, as long as they do not leak sensitive information
• Open redirects without severe user implications
• Rate limiting bypasses or lack of rate limiting
• Injection attacks without demonstrable impact on downstream systems
• Attacks that have exceptional and uncommon circumstances for exploit as a prerequisite, for example:
• Use of end-of-life software
• Man-in-the-middle conditions
• User manipulation via injected text content (spoofing)
• Attack vectors that require physical access to another user’s computer
• Self-directed attacks that only impact the browser used for exploit
• Security configurations that are not optimized or missing, for example:
• CORS misconfigurations without chained exploitation vectors
• Missing or misconfigured HTTP headers, Cookies, CSP policies, or SSL/TLS
• Blind SSRF evidenced only via DNS interaction
• Attacks that involve destructive or disruptive testing with an impact on availability. This type of testing is strictly forbidden

Reward Structure (USD)

Timelines

As part of our Bug Bounty program, Stay22 commits to the following standards, these are cumulative:

• Time to respond to report submissions: 5 business days
• Time to triage reported vulnerabilities: 10 business days
• Time to reward payout: 15 business days

Keep in mind these standards are subject to change without notice and are completely reliant on our internal process. You can expect the overall timeline from report to payout to be 30 business days, keeping in mind this is an average, some reports will be processed in a shorter timeframe, others will take longer based on complexity.

Legal

• You hereby grant to Stay22 a nonexclusive, worldwide, royalty-free, irrevocable, transferable, sublicensable, fully paid-up right and license to access, collect, use, process, store, transfer, transmit, copy, modify, adapt, and display any of your submissions and reports, including any data included thereto submitted by you under the Program for Stay22 business purposes, including enhancing Stay22 products and its other offerings. All rights not expressly granted under these Terms are reserved, and no additional rights whatsoever are granted by implication, exhaustion, estoppel or otherwise. YOUR PARTICIPATION IN THE PROGRAM IS AT YOUR OWN RISK. TO THE EXTENT PERMITTED BY APPLICABLE LAW, WE HEREBY DISCLAIM ALL EXPRESS, IMPLIED, COLLATERAL OR STATUTORY WARRANTIES, REPRESENTATIONS AND CONDITIONS IN CONNECTION WITH THE PROGRAM.
• TO THE EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL STAY22 BE LIABLE TO YOU FOR ANY: (A) DIRECT DAMAGES; OR (B) INCIDENTAL OR CONSEQUENTIAL DAMAGES SUCH AS LOSS OF REVENUE, LOSS OF PROFITS, LOSS OF BUSINESS OR ANTICIPATED SAVINGS, LOSS OF USE, LOSS OF GOODWILL, OR LOSS OF DATA, ARISING OUT OF OR IN CONNECTION WITH YOUR PARTICIPATION IN THE PROGRAM, EVEN IF WE WERE NOTIFIED IN ADVANCE OF THE POSSIBILITY OF SUCH DAMAGES.
• These Terms will be governed by and construed in accordance with the laws of the province of Québec and the federal laws of Canada applicable therein, without regard to conflicts of law principles. Any action or proceeding arising out of or relating to the Program and under these Terms will be initiated in Montréal, Québec and each party irrevocably submits to the exclusive personal jurisdiction and venue of such courts sitting therein. Notwithstanding the foregoing, this choice of jurisdiction does not prevent us from seeking remedies with respect to a violation of intellectual property rights in any appropriate jurisdiction.
• A waiver of any provision of these Terms must be in writing and a waiver in one instance will not preclude enforcement of such provision on other occasions.
• Any provision of these Terms found by a tribunal or court of competent jurisdiction to be invalid, illegal or unenforceable will be severed from these Terms and all other provisions of these Terms will remain in full force and effect.

If you have any questions or comments regarding these Terms or have questions, feedback, comments, requests and other communications relating to the Program, please contact us at security@stay22.com.