Braze, Inc.

Quick summary

• Test only the three bug-bounty-.braze-dev.com hosts listed below — all other Braze domains are out of scope
• No automated scanners, DoS, or large-scale discovery scans
• Use one test-account pattern: h1-username[+N]@wearehackerone.com
• Never contact Braze staff, customers, or vendors
• Questions about scope → [email protected]
• All Tags-related findings are temporarily out of scope
• CORS Reports on the domain https://bug-bounty-api.k8s.tools-001.d-use-1.braze-dev.com will not be accepted, as this is explicitly ment to have an open CORS policy. Any reports on this will be closed as Not Applicable.

** All SSRF vulnerabilities are currently out of scope while we work through the existing que and work on comprehensive fixes. Any SSRF that has been submitted prior to Monday April 6, 2026 will be validated, any net-new SSRF reports will be closed. An announcement will be made when SSRF is back in scope.

1 Program Overview

• Braze welcomes security researchers to help protect our customers and platform.
• This policy explains the rules of engagement, eligible targets, and reporting expectations.

Response Targets

2 Eligibility Guidelines

• Be at least 18 years old and not a Braze employee, contractor, or vendor.
• Use one HackerOne profile (duplicate accounts = program ban).
• Not reside in a country subject to comprehensive U.S. sanctions.
• Follow all program rules & HackerOne's Code of Conduct.
• Stop testing and report immediately if you encounter customer/employee data, pre-release content, or other confidential information.

3 Account Setup & Test Plan

1. Register your primary test account as <h1-username> on the signup page:
   https://bug-bounty.k8s.tools-001.d-use-1.braze.com/
   This registration site is not in scope for testing.
   Extra users: append +1, +2, … (e.g. alice+1). Confirmation arrives at your @wearehackerone.com email alias.

2. Use headers:

   Identifier	Format
   Your Username	X-Bug-Bounty: HackerOne-<username>
   Tool Identifier	X-Bug-Bounty: <toolname>

3. Do not submit Dashboard forms that reach Braze Support or other internal teams.

4. Keep request rates under 100 r/s — this is a shared staging cluster.

4 In-Scope Assets

==⚠ Links inside these hosts may point to production. Do not follow or test them.==

5 Rules of Engagement

• No automated scanners (e.g., Nuclei) or bulk discovery scans.
• No social engineering or contact with Braze employees, customers, or vendors.
• No DoS / DDoS / stress testing.
• Test only with accounts you own; do not test on production sites.
• Submit one vulnerability per report unless chaining is needed to show impact.
• Stored XSS must execute on an in-scope domain and access that domain's DOM/cookies.
• Access-control reports must include the exact roles/permissions of every account used.
• Rate-limit bypass reports must demonstrate security impact, not just traffic volume.

⚠️ Enforcement

• Any violation of the Rules of Engagement—especially testing outside the three bug-bounty *.braze-dev.com hosts will result in immediate removal from the Braze program and loss of future eligibility.

6 Ongoing Exclusions

• All Access Control issues related to permissions are out of scope as of Feb 6, 2026. An announcement will be made when this comes back in-scope.
• Tags feature – any vulnerability involving creation, deletion, or update of Tags is out of scope until systemic issues are resolved (we'll announce when they return).
• Org-local data only – user-data exposure that affects only your own org is out of scope; show cross-org impact to qualify.
• DMARC/SPF issues, localhost / 0.0.0.0 SSRF, cosmetic bugs, and rate-limit findings on this dev cluster.
• Discovery-only results (port scanning, subdomain enumeration, Google dorks, etc.).
• Tests requiring physical device access.

7 Known Issues (not bounty eligible)

The items below are accepted risk or exist only in the test environment. Reports will be closed duplicate or informative:

• Dashboard breakage via invalid parameters – Reports that only make a dashboard feature fail to load for users in your own org are considered product bugs (effective 15 May 2025). Eligible only if an unauthorized user can trigger it or it disrupts all orgs.
• Cross-Origin Request Trust when uploading users or user profile images.
• CSV injection on user upload.
• Several horizontal IDOR patterns currently under remediation — higher duplicate probability.
• Webhook SSRF reachable only to 0.0.0.0 / other localhost variants.
• Editor XSS – payloads that fire only on the separate editor domain and cannot access the dashboard's DOM/cookies are out of scope. Stored XSS must fire in the dashboard context to be eligible.
• Disclosure of Internal Groups/Test Users (this is just test data).

8 Documentation

• User Docs – https://www.braze.com/docs/
• Role Management – https://www.braze.com/docs/user_guide/administrative/manage_your_braze_users/
• API Docs – https://www.braze.com/docs/api/basics/

Thank you for helping keep Braze and our users safe!