Sprinklr, Inc bug bounty programs

Out of scope 29

Don't test these. A program can exclude a host another program covers; the program you report to decides.

• Any activity that could lead to the disruption of our service (DoS)

• Attacks requiring MITM or physical access to a user's device

• Cache Poisoning

• CAPTCHAs missing as a Security protection mechanism

• Clickjacking on pages with no sensitive actions

• Comma Separated Values (CSV) injection without demonstrating a vulnerability

• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS

• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions

• HttpOnly or Secure flags on cookies

• Issues that require unlikely user interaction

• Missing best practices in Content Security Policy

• Missing best practices in SSL/TLS configuration

• Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc)

• Open redirect - unless an additional security impact can be demonstrated

• Previously known vulnerable libraries without a working Proof of Concept

• Rate limiting or bruteforce issues on non-authentication endpoints

• Security headers/attributes missing such as, but not limited to “content-type-options”, “X-XSS-Protection”

• Self-type Cross Site Scripting / Self-XSS

• Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors)

• Tabnabbing

• UI and UX bugs and spelling mistakes

• Use of a known-vulnerable library without proof of exploitability;

• Username enumeration

• Vulnerabilities contingent on physical attack, social engineering, spamming, DDOS attacks, etc

• Vulnerabilities in third-party software, libraries and code

• Vulnerabilities on sites hosted by third parties unless they lead to a vulnerability on the main website

• Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]

• Vulnerabilities relying highly on social engineering aspect

• Vulnerabilities relying on the existence of plugins such as Flash