Gearset: Managed Bug Bounty

Description

No technology is perfect and Gearset believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our web app. Good luck, and happy hunting! Gearset For this program, we're inviting researchers to test our Web application and API. Our primary goal is to ensure customer's data is protected and our application is free from security vulnerabilities. Release frequency Gearset regularly releases new code. Our staging environments release changes multiple times per hour, so we would encourage you to regularly visit us. Major functionality will be mentioned in the announcement section, but you can also check the in-app changelog, as well as our blog . Out of scope testing: Testing is only authorized on the targets listed as In-Scope. Any domain/property of Gearset not listed in the targets section is out of scope. This includes any/all subdomains not listed. If you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Gearset, it may be reported to this program, and is appreciated - but will ultimately be marked as ‘not applicable’ and will not be eligible for monetary or points-based compensation.

Targets

Testing is only authorized on the targets listed as In-Scope. Any domain/property of Gearset not listed in the targets section is out of scope. This includes any/all subdomains not listed above. IF you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Gearset, it may be reported to this program, and is appreciated - but will ultimately be marked as ‘not applicable’ and will not be eligible for monetary or points-based compensation. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Target Information: Access: Public Internet Gearset Targets Documentation: https://docs.gearset.com/en/ We recommend you to go through the following docs: Getting started with Gearset What is Gearset Key Features Feature guides Credentials: To gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . You may register for accounts here . You will need a developer Salesforce account that can be created here . Clayton/CodeReviews Targets Documentation: https://docs.gearset.com/en/collections/13062331-code-reviews We recommend you go through the following docs: Getting started with Code Reviews Launch your first code review Code Reviews integrations Understanding user roles API Swagger documentation Out-of-Scope Researchers should only use our staging environment. Our production environment is not to be used. Please do not use: Third party domains including any Salesforce domains Third party chat widget (sales & support) Our marketing site (gearset.com) is also out of scope. Known Items Exposed Raygun API keys - We have implemented as per the documentation for client JS applications and thus standalone submissions stating it is exposed in the client are out of scope. Some features intentionally make server-side requests to user-supplied URLs. Demonstrating as a standalone issue that we fetch an external, publicly accessible and attacker-controlled URL without any further impact will be considered out of scope. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via [email protected] before going any further.

Gearset Staging (in scope)

Tech stack: Typescript, React, Redux .NET 10, ASP.NET Postgres RDS Kubernetes Focus areas: Gearset agent ( docs ) - AI agent controlled with free form prompt to build changes in git ready for a Salesforce org If you require access please reach out to [email protected] so we can get you set up You’ll need to have set up a pipeline to get started ( docs ) We won’t reward for reports getting the agent to divulge details about its environment AI powered UI testing tool ( docs ) - a tool to drive browser based testing of a Salesforce org, AI prompts used to generate steps Org Intelligence ( docs ) - a tool to explore the configuration of a Salesforce org and understand how it is set up Cross team vulnerabilities - a customer on team A should not be able to read data about a customer on team B XML and user controlled code - we handle large amounts of XML and git repositories in different and interesting ways

Gearset Public API (in scope)

Getting started We provide a getting started guide for our customers, which explains how to create access tokens and make your first request. This can be found here . The only difference to the above is that you should be using https://staging-api.gearset.com rather than https://staging.gearset.com to make API request, and you should be logging in our test instance . Docs For more information, please view our API docs . These contain curl commands which you can use to send requests to our API.

HIPAA Gearset Staging (in scope)

Summary: The same API as Gearset Staging. Customer accounts must be added manually by Gearset and researchers will not be given accounts, so should not be able to access any meaningful data or make any changes on this system.

Clayton Staging (in scope)

Tech stack: Java 21 (Amazon Corretto), Spring Boot, Spring Security Postgres (RDS), Hibernate/JPA OpenSearch Focus area: Authentication & SSO ( docs ) - OAuth2, SAML2 SSO flows, MFA, session management, API key auth Multi-tenancy & data isolation - Customer on Workspace A should not be able to read/modify data belonging to another customer on Workspace B VCS connections ( docs ) - GitHub, GitLab, Bitbucket, Azure DevOps connection management and token handling Policy & rule management ( docs ) - Custom policy CRUD, versioning, attachment to projects Pull request scanning ( docs ) - Scan operations, quality gates, webhook-triggered scans Webhooks ( docs ) Inbound webhooks from VCS platforms—signature validation, event injection Outbound webhooks—SSRF, data leakage User roles & permissions ( docs ) - Account-level and project-level role enforcement, privilege escalation

Clayton Public API (in scope)

Getting started We provide documentation on how to invoke Code Reviews APIs using OAuth2 here . Use staging.claytonapp.com rather than the production API endpoint. Generate API credentials from your staging workspace settings . Docs For more information, view our API docs . These contain endpoint definitions you can use to test the API directly.

Out of scope targets (out of scope)

Researchers should only use our staging environment. Our production environment is not to be used. Any domain/property of Gearset not listed in the targets section is out of scope (this includes our marketing website gearset.com). This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Gearset, it may be reported to this program, and is appreciated - but will ultimately be marked as 'not applicable' and will not be eligible for monetary or points-based compensation.