Smartsheet (VDP)

Do:

• Provide detailed reports with reproducible steps, video POCs and screenshots — reports that cannot be reproduced will not be triaged.
  • Include a self-contained proof of concept, along with any required preconditions, raw http request/response pairs and the expected result.
  • Include a clear impact statement with security implications covering what an attacker gains or what data and actions become accessible.
• Submit one vulnerability per report, unless chaining vulnerabilities is necessary to demonstrate impact.
• Combine reports when the same root cause affects multiple endpoints, subdomains, or assets — do not submit them as separate reports.
• Review Core Ineligible Findings and Scope Exclusions for report categories that should not be submitted.

Do NOT:

• Disruptive testing — mass scan Smartsheet domains, conduct DoS/DDoS attacks, brute force credentials, or engage in any activity that degrades or interrupts Smartsheet services or our customers' use of them.
• Unauthorized system access — upload shells, create backdoors, maintain persistent access, initiate fraudulent transactions, deface or modify public-facing content, or exploit a vulnerability beyond what is minimally necessary to demonstrate its existence.
• Unauthorized data access — access, modify, copy, download, or delete data belonging to accounts not your own. Do not exfiltrate any data beyond what is minimally necessary to demonstrate a vulnerability exists.
• Social engineering — engage in phishing, vishing, smishing, or any other form of social engineering against Smartsheet employees, customers, or vendors.
• Communications — contact the Smartsheet security team directly about the status of a submitted report. All vulnerability-related communications must remain within the HackerOne platform.

Disclosures

• Do not discuss this program or any discovered vulnerabilities — including resolved ones — outside of the HackerOne platform without express written consent from Smartsheet. This restriction applies to all public and private communication, including social media, blog posts, conference talks, and third-party platforms.

Credentials

• Use only HackerOne-based accounts you own or have explicit permission from the account holder to use.
• Include your HackerOne username in all HTTP(S) requests using the header: X-BUG-BOUNTY: [H1 username]

Legal

By participating in Smartsheet’s vulnerability disclosure program (the “Program”) administered by HackerOne, Inc. (“HackerOne”), including by submitting through HackerOne any report, information, or materials (including methods and proof-of concept materials therein) that identify or relate to a suspected or actual security vulnerability, bug, or flaw in Smartsheet’s systems, products, or services (each, a “Submission”), you agree to these terms and conditions (“Terms”) which form a binding agreement between you and Smartsheet Inc. (“Smartsheet”).

Subject to these Terms, you are authorized to perform good-faith security and bug testing of Smartsheet’s systems, products, and services, limited to your own accounts and devices. You will not: (a) access customer or employee personal information, pre-release Smartsheet content, or Smartsheet confidential information; (b) violate any law, or intentionally access, disrupt, or compromise data that is not yours; (c) participate for any malicious or fraudulent purpose; or (d) conduct denial-of-service attacks, social engineering of Smartsheet personnel, contractors or customers, physical intrusion attempts against Smartsheet facilities, or automated scanning that generates excessive traffic. If you inadvertently access data that is not yours, stop testing and submit the vulnerability immediately, even if the finding is incomplete

As a condition of participation, you assign to Smartsheet all right, title, and interest in and to each Submission including all intellectual property rights, and, to the extent permitted by law, waive any moral rights therein. All Submissions are Smartsheet’s confidential information and you will not disclose, publish, or otherwise use or exploit them or any information learned in connection with the Program, without Smartsheet's prior written consent.

You must comply with all applicable laws in connection with the Program which is not an offer of employment. You participate as an independent contractor; nothing herein creates any employment, agency, partnership, joint venture, or fiduciary relationship between you and Smartsheet and you are solely responsible for all taxes and similar obligations on any reward you may receive. You represent that you are at least 18 years old, are not a current employee or contractor of Smartsheet, not located in, organized under the laws of, or ordinarily resident in a country subject to comprehensive U.S. sanctions, are not listed on the U.S. Treasury Department’s Specially Designated Nationals and Blocked Persons List or any applicable U.S. government restricted-party list, and that your participation does not violate any applicable export control laws, including the U.S. Export Administration Regulations.

HackerOne acts independently of Smartsheet. You will not hold Smartsheet, its parents and affiliates, or their respective officers, directors, employees, and agents (the “Smartsheet Parties”) liable for any act or omission of HackerOne, including any failure to pay any reward or other amount owed to you.

You will indemnify and hold harmless the Smartsheet Parties from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable attorney’s fees) arising out of or relating to (i) your use or disclose of any Submission beyond the scope permitted by these Terms, (ii) your breach of any provision of these Terms, or (iii) your gross negligence, willful misconduct, malicious acts or omissions, or fraud.

THE PROGRAM IS PROVIDED “AS IS” AND SMARTSHEET DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, REGARDING THE PROGRAM. TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SMARTSHEET PARTIES WILL NOT BE LIABLE TO YOU FOR ANY DAMAGES ARISING OUT OF OR RELATING TO THE PROGRAM OR THESE TERMS, AND THE SMARTSHEET PARTIES’ AGGREGATE LIABILITY TO YOU WILL NOT EXCEED THE AMOUNT, IF ANY, PAID TO YOU AS A REWARD UNDER THE PROGRAM.

Smartsheet may modify these Terms or terminate the Program at any time. These Terms are governed by the laws of the State of Washington, without regard to its conflict-of- laws principles, and any dispute is subject to the exclusive jurisdiction of the state and federal courts in Seattle, Washington. As between you and Smartsheet, these Terms control as to the Program in the event of a conflict with any other terms, including any terms between you and HackerOne.