Tines (VDP)

#We ask that you adhere to the following guidelines:

Please use the following paths for new account signup & login! If you are using your HackerOne email alias or the X-HackerOne-Research: [H1 username] as outlined in the "Test Plan" & "Session Layer" sections of the program guidelines below, you will be redirected to the listed paths. https://login.tines.com/research/signup https://login.tines.com/research/login

You may also use the attached Burp Suite project setting config (F5313538), or add the provided ZAP replace config at the end of your "replacer" element within the XML config (F5313534) which can be found in ZAP (Help > Support Info... > Scroll to the bottom and find "ZAP Home Directory" > In the ZAP home directory open config.xml > search for "replacer" > add the rule at the end of the element). In either scenario, please modify the [H1 username] placeholder value to match your specific username.

*Do not disclose the vulnerability outside of the VDP *Do not violate any laws *Do not disrupt services (DoS/DDoS) *Do not access, modify, or destroy any accounts or data that do not belong to you

Tines has extensive documentation of our features & API's, and their intended uses, available on our marketing site. https://www.tines.com/docs/quickstart/ https://www.tines.com/api/welcome/

When submitting reports on potential vulnerabilities, please consider the real-world implications of the potential vulnerability and if the report indicates a real-world impact, such as privilege escalation, sensitive information disclosure, or the ability to affect resources not owned by the tenant/team they are associated with. This includes recognizing that the Tines Intelligent Workflow platform is designed to allow Tenant Owners full control over resources within their specific tenant.

Regarding the Tines run-script feature, before submitting a potential vulnerability report, please assess if the team/tenant isolation is able to be compromised or escaped from. For more information on the run-script feature please see our extensive documentation. https://www.tines.com/docs/actions/tools/run-script/ https://www.tines.com/blog/python-tines-how-to-guide/

You can find more information regarding security at Tines here: https://www.tines.com/security/

#Out of Scope

• HTTPS / TLS security headers suggestions
• Direct testing of 3rd parties
• SPF / DMARC / DKIM / DNSSEC suggestions
• Banner/version disclosure
• Social engineering / phishing / spam

Program Rules

• Please see the Test Plan below for information on account creation.
• Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
• Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
• When duplicates occur, we only triage the first report received (provided that it can be fully reproduced).
• Only interact with accounts you own or with the explicit permission of the account holder.

Test Plan

• Users are able to sign up for a free account through our website
• All researchers are required to use their hacker email alias or the X-HackerOne-Research header when testing ([email protected])
• Researchers using @gmail.com or any other domain other than their hacker email alias, without also using the provided headers, are subject to Tines account deletion and possible program exclusion

Session Layer: HTTP Headers

Researchers must add headers to requests if not using the @wearehackerone.com email alias, such as:

• “X-HackerOne-Research: [H1 username]”

Thank you for helping keep Tines and our users safe!