Contentsquare Bug Bounty Program

Company

Contentsquare is a fast-growing startup founded in 2012 with the mission to improve digital experiences across the board. To do this, we developed an innovative SaaS solution that helps businesses understand how people are behaving on their digital platforms and how they can optimize the customer journey.
https://contentsquare.com/

In addition to web-based platforms, we also provide a mobile SDK (Software Development Kit) that helps our customers to optimize and understand what’s going on their mobile applications. Please find more information in the dedicated section below.

Please make sure to check the scope page before you start writing your report to make sure the security issue you are reporting is within the scope of the program.

Eligibility and Responsible Disclosure

If you believe you've found a security bug in our service, we are happy to work with you to resolve the issue promptly and ensure you are fairly rewarded for your discovery.

• Any vulnerability found must be reported exclusively through yeswehack.com
• Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
• Provide us a reasonable amount of time to understand, analyse and resolve the issue
• No vulnerability disclosure to any third-parties, including partial is allowed without formal acknowledgement of Contentsquare staff
• You must be the first reporter of a vulnerability and the vulnerability must be a qualifying vulnerability
• You must not be a former or current employee of Contentsquare or one of its contractor
• You must not be a client if you are reporting a security issue that is authenticated from a valid account you already have.
• A security issue that requires authenticated access from a valid personal account you already have, is not eligible for reward
• You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary
• If you find the same vulnerability several times, please create only one report and eventually use comments. You'll be rewarded accordingly to your findings and the criticity of the asset found vulnerable.

Reports of leaks and exposed credentials

In the context of this program, we do not intend to encourage, accept or reward reports of leaks that are not applicable to our program’s scope and identified outside of our program’s scope, such as:

• Exposed credentials in/from an out-of-scope asset/source
• Sensitive information exposed in/from an out-of-scope asset/source

Also, in order not to encourage dark and grey economies, in particular the purchase, resale and trade of identifiers or stolen information, as well as all types of dangerous behavior (e.g. social engineering, ...), we will not accept or reward any report based on information whose source is not the result of failure on the part of our organization or one of our employees/service providers.

This excludes, but is not limited to:

• Stolen credentials gathered from unidentified sources (e.g. …)
• Exposed credentials that are not applicable on the program’s scope
• Exposed GitHub/GitLab (or similar) instance with no direct relation with our program’s scope
• Exposed secrets (e.g. API tokens/keys or other technical credentials) that are not directly related to the program’s scope
• Exposed PII on an out-of-scope asset

To summarize our policy, you may refer to this table :

	Source of leak is in-scope	Source of leak belongs to MyCompany but is out-of-scope	Source of leak does not belong to MyCompany and is out-of-scope
Impact is in-scope (e.g. valid credentials on an in-scope asset)	Eligible	Eligible	Not Eligible
Impact is out-of-scope (e.g. valid credentials for an out-of-scope asset)	Eligible	Not Eligible	Not Eligible

Regarding Subdomain Takeovers

• Reports submitted by you in which you cannot demonstrate your ownership of the domain are not reward eligible
• Host your proof of concept in a subdirectory and include your YesWeHack username.
• We recommend using HTML comments instead of hosting the proof-of-concept file on the main domain page.
• Subdomain takeover will only be eligible for reward if they pertain to *.contentsquare.com

Scope for the mobile SDK

We are also interested in findings related to our mobile SDK and the collection endpoints (mobile-production.content-square.net, m.csqtrk.net and s.contentsquare.net). To learn how to use and to integrate our SDK to your mobile application, please read our public documentation at https://docs.contentsquare.com/mobile-sdk-en/
In addition, you can check out the sample applications below to understand how to use our SDK.

IOS sample app:
https://github.com/ContentSquare/iOS-sample-app/

Android sample app:
https://github.com/ContentSquare/Android-sample-app

React native npm package:
https://www.npmjs.com/package/@contentsquare/react-native-bridge

Please note that we do not consider vulnerabilities related to the sample applications, but only the ones that cause by our SDK
https://docs.contentsquare.com/react-native/

Rewards

Currently, the scope of our bug bounty program is limited to certain vulnerabilities and scope.

If you find the same vulnerability several times, please create only one report and eventually use comments. You'll be rewarded accordingly to your findings.
The triage team will use the "One Fix One Reward" process: if two or more endpoints/forms use the same code based and a single fix can be deployed to fix all the others weakness, only one endpoint will be considered as eligible for a reward and other reports will be closed as Informative.

Please note that Contentsquare will determine in its discretion whether a reward should be granted and the amount of the reward. But we aim to be fair.