Keeper Security Public Bounty Program

Description

Keeper Security is transforming the way businesses and individuals protect their passwords and sensitive digital assets to significantly reduce cyber theft. Keeper is SOC 2 Certified, ISO 27001 Certified, FedRAMP Authorized and utilizes best-in-class encryption to safeguard its customers. Keeper Security is committed to the industry best practice of responsible disclosure of potential security issues. Guidelines: This Vulnerability Disclosure Policy sets out expectations when working with good-faith hackers, as well as what you can expect from us. If security testing and reporting are done within the guidelines of this policy, we: Consider it to be authorized in accordance with Computer Fraud and Abuse Act, Consider it exempt from DMCA, and will not bring a claim against you for bypassing any security or technology controls, Consider it legal, and will not pursue or support any legal action related to this program against you, Will work with you to understand and resolve the issue quickly, and Will recognize your contributions publicly if you are the first to report the issue and we make a code or configuration change based on the issue. If at any time you are concerned or uncertain about testing in a way that is consistent with the Guidelines and Scope of this policy, please contact us before proceeding. To encourage good-faith security testing and disclosure of discovered vulnerabilities, we ask that you: Avoid violating privacy, harming user experience, disrupting production or corporate systems, and/or destroying data, Perform research only within the scope set out below, and respect systems and activities which are out-of-scope, Contact us immediately if you encounter any user data during testing, Use the identified communication channels to report vulnerability information to us and, Keep information about any vulnerabilities you’ve discovered confidential until we’ve resolved them. Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority. Please review the Quality Reporting section for additional guidelines as it pertains to Ratings/Rewards Note: To unwrap and display Vault <> Server communication on the Web Vault, open the developer tools and type: enableNetworkLog(true) This will allow you to see the request/response to the server in JSON On the Admin Console, the command to log additional request/response is: api.shouldLog=true If you need additional debug help, feel free to email us at [email protected]. VRT Changes: Any submissions stemming from throttling or spam testing will be rated as a P4. Any domain/property of Keeper Security not listed in the targets section is out of scope. This includes any/all subdomains not listed above. This includes kepr.co and kepr.io.

Targets

Any domain/property of Keeper Security not listed in the targets section is out of scope. This includes any/all subdomains not listed above. Access/Credentials Please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Target Info Enterprise License To create a 14-day Enterprise trial license, follow this step by step guide . Once you're logged into the admin console, follow the instructions in the Admin Guide to set up other components such as SSO Connect Cloud, SSO Connect On-Prem, Active Directory Bridge, etc... Personal License To create a 30-day personal trial, go to the Web Vault in the destination region and click Create Account: Web Vault (US) Web Vault (EU) Web Vault (AU) Web Vault (JP) Web Vault (CA) Web Vault (US GovCloud) Quality Reporting When reporting an issue to this program, please be sure to include the following: Issue Name/Title of Vulnerability Description of the vulnerability identified Description of the impact Detailed replication steps along with screenshots, in a step-by-step manner that could be followed by non-security personnel Impacted/Affected URL/Domain Risk rating of the identified vulnerability CVSS score and business impact of the vulnerability to justify the risk rating A real-world exploit scenario explaining what an attacker could do with this vulnerability and how they would do it Clear explanation of the required attacker position, prerequisites, and assumptions Evidence that the issue creates meaningful security impact against another user, customer, tenant, or Keeper-managed system Actionable remediation guidance Submissions lacking detailed exploitation steps, validated impact, and a realistic exploit scenario will not be eligible for reward. Reports that are theoretical, speculative, based only on automated scanner output, or dependent on unrealistic assumptions are not eligible for reward. Targets KeeperFill Browser Extension - Click Here Keeper Web Vault - Click Here Keeper Admin Console - Click Here Keeper Desktop Application - Click Here Keeper Secrets Manager - Click Here Keeper Commander - Click Here Keeper Connection Manager - Click Here Keeper SSO Connect Cloud - Click Here Keeper SSO Connect On-Prem - Click Here Keeper AD Bridge - Click Here Keeper for iOS - Click Here Keeper for Android - Click Here KeeperChat for iOS - Click Here KeeperChat for Android - Click Here KeeperChat for Mac - Click Here KeeperChat for Windows - Click Here Keeper Website - Click Here Keeper Checkout Pages - Click Here Additional Notes Please keep in mind as you test the targets, particularly the websites, that these are production systems. Please abstain from running automated tools against contact forms or other areas where it appears the form may submit to a human or team on the other end. Manual testing is highly encouraged and recommended in such places and situations. Keeper's server communication uses an AES transmission key on top of TLS, which makes it very difficult to intercept using typical tooling. On the Web Vault, to unwrap and display Vault <> Server communication, open the developer tools and type: enableNetworkLog() This will allow you to see the request/response to the server in the output logs. On the Admin Console, the command to log additional request/response is: enableLogging() Also note that Keeper device approval can be configured to use IP-based approval. To turn this on or off, visit the Vault settings screen of the vault. We are happy to assist you with debugging and product usage. We will disqualify any submission that is clearly AI slop. Any researcher that repeatedly sends AI-generated reports with no real-world impact may be disqualified. Program Focus This program is focused on high-impact security vulnerabilities with a clear, realistic exploit path and material impact to Keeper, Keeper customers, or Keeper-managed data. Accepted submissions should generally demonstrate impact consistent with P1 or P2 severity. Reports should show a practical attack path that results in one or more of the following: Authentication bypass Device approval bypass Remote code execution Unauthorized access to sensitive customer data, vault data, secrets, or administrative functionality Cross-tenant, cross-account, or cross-region data access Meaningful privilege escalation Bypass of access controls or security controls protecting customer data Cryptographic, key-management, or encryption flaws with demonstrated exploitability and material impact High-impact vulnerabilities in customer-facing web applications, APIs, desktop applications, mobile applications, or supported Keeper services Reports must demonstrate realistic impact against another user, customer, tenant, or Keeper-managed system. Reports that affect only the researcher’s own account, require unrealistic assumptions, or do not demonstrate material security impact are not eligible for reward. Focus Areas The following categories are in scope when the report demonstrates realistic P1/P2-level impact: Authentication bypass Device approval bypass Authorization bypass or access control failures Remote code execution Meaningful privilege escalation Unauthorized access to sensitive customer data Cross-tenant or cross-account data exposure High-impact information disclosure involving secrets, vault data, credentials, tokens, private keys, or administrative data Vulnerabilities in supported customer-facing web applications and APIs Vulnerabilities in supported desktop applications or mobile applications Cryptographic or key-management vulnerabilities with a demonstrated exploit path and material customer impact Cross-site scripting or cross-site request forgery only where the report demonstrates meaningful account, tenant, administrative, or sensitive-data impact Timing, enumeration, or oracle-style attacks only where the report demonstrates tangible security or privacy impact Out-of-Scope The following are out of scope unless the report demonstrates a separate Keeper product vulnerability that creates meaningful additional impact: Spam or Email Spoofing Issues requiring local compromise of the victim’s device Issues requiring keylogging, malware, malicious local scripts, malicious browser extensions, or arbitrary code execution on the victim’s system Issues requiring a full compromise of the operating system Issues requiring admin, root, SYSTEM, physical access, or equivalent privileged access Issues requiring access to an unlocked, already-authenticated, or already-compromised user session Issues requiring possession of credentials, private keys, recovery phrases, tokens, device keys, encryption keys, or other secrets not obtained through the reported vulnerability Issues where the only affected victim is the researcher or the researcher’s own account Self-XSS or self-impact issues that cannot be triggered against another user or tenant Social engineering, phishing, user deception, or attacks that depend primarily on tricking a user into unsafe behavior Attacks that depend on a compromised account, malicious insider, intentionally misconfigured environment, or customer-controlled insecure configuration Issues involving legacy, unsupported, or out-of-date versions of Keeper applications Rate limit testing Reports based primarily on automated scanner output without validated exploitability and real-world impact AI-generated or low-quality reports that do not demonstrate a real exploit path and material impact Theoretical weaknesses, best-practice recommendations, missing headers, version disclosures, or informational findings without a demonstrated path to meaningful security impact Issues on the Gateway, Automator, SSO Connect, or other hosted services that require physical access Any kind of attack where the only victim is yourself, including self-XSS of a profile picture or information that does not show anywhere else. You must provably show that the attack can affect another user, customer, tenant, or Keeper-managed system. Any Keeper domain, subdomain, product, service, or property not explicitly listed in the Targets section Triage Guidance Bugcrowd triage should only escalate reports that include a realistic exploit path, sufficient reproduction steps, and demonstrated security impact aligned with the program’s accepted vulnerability categories. Reports should be closed as out of scope, not applicable, or informational when they rely primarily on excluded assumptions, do not demonstrate P1/P2-level impact, or fail to show how an attacker could realistically exploit the issue against another user, customer, tenant, or Keeper-managed system. Submissions lacking detailed exploitation steps, validated impact, and a real-world attack scenario are not eligible for reward. Documentation on the Keeper platform is linked below: Enterprise Platform Guide: https://docs.keeper.io/enterprise-guide/ Encryption and Security Model: https://docs.keeper.io/enterprise-guide/keeper-encryption-model End-User Guides: https://docs.keeper.io/user-guides/ Keeper SSO Connect Cloud Guide: https://docs.keeper.io/sso-connect-cloud/ Keeper SSO Connect On-Prem Guide: https://docs.keeper.io/sso-connect-guide/ Keeper Secrets Manager: https://docs.keeper.io/secrets-manager/ Keeper Connection Manager: https://docs.keeper.io/keeper-connection-manager/ KeeperPAM: https://docs.keeper.io/pam/ KeeperDB: https://docs.keeper.io/en/keeperpam/privileged-access-manager/keeperdb

Additional information

This bounty requires explicit permission to disclose the results of a submission.