Varonis

Varonis Bug Bounty Program

At Varonis, data is at the center of everything we protect. Our Data Security Platform helps organizations discover sensitive data, reduce their blast radius, remediate exposure, detect abnormal activity, and stop threats before they result in a data breach. Through visibility, automated prevention, proactive detection, and response, Varonis protects sensitive data across identity, cloud, applications, email, and AI environments.

Our public bug bounty program extends that mission to our own internet-facing attack surface. We work with the security research community to identify vulnerabilities that could:

• Expose Varonis, employee, partner, or customer data
• Provide unauthorized access to Varonis systems or production services
• Cross customer, tenant, privilege, or trust boundaries
• Compromise the confidentiality, integrity, or availability of our products and services
• Create a practical path to account takeover, data exposure, code execution, or abuse of security-sensitive functionality

We value quality over quantity. Show us the realistic attack path, the security boundary crossed, and the impact an attacker could achieve, while using the minimum testing necessary to prove the issue.

Severity and Rewards

Varonis determines rewards based on the validated severity, exploitability, affected asset, and demonstrated impact.

Reward Range

Reward Determination

Varonis uses CVSS v3.1 as a baseline for severity, but the final rating and bounty reflect the vulnerability's validated, real-world impact.

Varonis may consider:

• Affected asset and environment
• Exploitability, complexity, and required privileges
• Customer, tenant, or sensitive-data impact
• Account takeover or privilege-escalation potential
• Existing mitigations and compensating controls
• Confidentiality, integrity, and availability impact
• Report quality and reproducibility

Rewards generally fall within the published Expected Reward Range for the validated severity. Varonis may adjust the severity or bounty when the practical impact differs from the initial CVSS score.

Rules of Engagement

Identify Your Testing

Set a custom HTTP header in all testing traffic. Include the header you used in your vulnerability report so Varonis can identify your activity and deconflict it from other testing.

Stay Within Scope

• Test only assets explicitly listed as in scope
• Follow all asset-specific restrictions
• Do not attempt to access any employee, customer, partner, or third party accounts

Use Safe Testing Methods

• Use the minimum testing necessary to confirm a vulnerability and its impact
• Do not alter, delete, corrupt, encrypt, ransom, or destroy data
• Do not establish persistence or pivot into other systems or environments
• Do not download databases, bulk records, files, mailboxes, logs, or datasets
• Do not intentionally degrade availability or performance

Prohibited Activities

Unless Varonis expressly authorizes the activity in writing, do not perform:

• Denial-of-service, distributed denial-of-service, stress, load, or resource-exhaustion testing
• Password spraying, credential stuffing, brute forcing, or credential guessing
• Phishing, vishing, smishing, pretexting, impersonation, or other social engineering
• Physical security testing
• Man-in-the-middle attacks requiring control of another person's network or device
• Testing against employees, customers, partners, suppliers, or vendors
• Malware deployment, persistence, ransomware, destructive payloads, or data encryption
• Excessive or unsafe automated scanning
• Actions that violate applicable law or third-party terms

Eligible Vulnerabilities and Focus Areas

Our focus areas are informed by the OWASP Top 10:2025, but not all OWASP vulnerabilities are automatically eligible. In-scope vulnerabilities include but are not limited to:

Access Control and Tenant Isolation

• Cross-tenant or cross-customer data access
• Insecure direct object reference
• Horizontal or vertical privilege escalation
• Unauthorized access to administrative functions
• Server-side Request Forgery (SSRF) with demonstrated impact

Authentication and Session Security

• Authentication bypass
• Account takeover
• Multi-factor authentication bypass
• Improper token validation
• Session fixation or session confusion
• OAuth, SAML, OIDC, or SSO implementation flaws with demonstrated impact

Injection and Server-Side Exploitation

• SQL injection
• Command injection
• Server-side template injection
• Remote code execution
• Unsafe deserialization
• Directory traversal, arbitrary file read or write
• File upload vulnerabilities leading to a practical exploit path
• XML external entity processing with demonstrated impact

Data, Secrets, and Cryptography

• Unauthorized access to sensitive or customer-related data
• Exposed credentials, API keys, tokens, signing material, or secrets
• Cryptographic implementation flaws with demonstrated impact
• Data exposure that materially increases the impact of another compromise

Client-Side and Request Integrity

• Stored cross-site scripting with a realistic victim and impact scenario
• DOM-based vulnerabilities that cross a security boundary
• CSRF affecting privileged or security-sensitive actions

APIs and Business Logic

• API authorization or authentication failures
• Mass assignment with demonstrated impact
• Business-logic abuse and workflow manipulation
• Race conditions with demonstrated impact
• Security-control bypass
• Abuse of privileged integration or automation functionality
• Improper enforcement of quotas or limits resulting in meaningful impact

Supply Chain and Security Misconfiguration

• Dependency or supply-chain weaknesses with a working proof of concept against an in-scope asset
• Exploitable cloud or application misconfiguration
• Failure conditions that expose data or fail open
• Security logging or alerting weaknesses only where the report demonstrates an exploitable security bypass or meaningful concealment capability

Out-of-Scope Findings

The following findings are not eligible unless the report demonstrates a realistic exploit path and meaningful additional impact.

Low-Impact Web Findings

• Clickjacking on pages without sensitive actions
• Self-XSS
• Tabnabbing
• Open redirect without additional demonstrated impact
• Content spoofing or text injection without a practical attack scenario
• CSRF affecting unauthenticated forms or non-sensitive actions
• Issues requiring highly unlikely or impractical user interaction
• Reflected XSS without a realistic victim path or meaningful security impact

Security Hardening and Configuration

• Missing recommended HTTP security headers without demonstrated impact
• Content Security Policy recommendations without a demonstrated bypass
• Missing HttpOnly, Secure, or SameSite cookie attributes without demonstrated impact
• SSL/TLS hardening recommendations without practical impact
• Missing or incomplete SPF, DKIM, or DMARC records without demonstrated impact

Informational Findings

• Software or framework version disclosure
• Server banners or technology fingerprinting
• Verbose response headers
• Descriptive errors or stack traces without exploitable information
• Publicly available information
• Directory or filename exposure without unauthorized content access

Rate Limiting and Enumeration

• Rate limiting on non-sensitive or non-authentication endpoints without demonstrated impact
• Username, email, hostname, or tenant enumeration without a practical attack path
• Theoretical brute-force concerns
• Rate-limit bypasses that do not materially change exploitability or impact

Dependencies, Known Issues, and Unsupported Software

• Vulnerable software identification without a working proof of concept against an in-scope asset
• Findings based only on version matching, already-known vulnerabilities, duplicate or previously reported issues
• Recently disclosed vulnerabilities within the first 30 days of disclosure
• Issues affecting only unsupported or materially outdated browsers, clients, or operating systems

Insufficient Evidence

• Scanner-only findings
• Missing reproduction steps
• Missing proof of concept
• Missing demonstrated impact
• Theoretical findings
• AI-generated claims that have not been verified
• Reports that do not account for existing mitigations
• CSV injection without a practical exploit path
• Fabricated endpoints, requests, responses, or evidence

Leaked Credentials

Reports involving exposed credentials may be reviewed when:

• The credentials apply to an in-scope, Varonis-owned or Varonis-operated system
• The researcher identifies the lawful source
• The exposure was not purchased or obtained through an unauthorized or criminal source

The following are out of scope:

• Credentials for third-party services where a Varonis email address is only the username
• Credentials purchased by the researcher
• Reports that do not identify the source
• Credentials unrelated to an in-scope Varonis service

Do not validate exposed credentials unless the applicable scope instructions expressly permit limited validation. Never access, enumerate, modify, download, or retain data using exposed credentials.

Duplicate and Related Reports

• The first complete, reproducible report of a vulnerability is generally eligible for the bounty
• Later reports sharing the same root cause may be closed as duplicates even if they use a different parameter, endpoint, payload, or technique
• Multiple effects caused by one underlying flaw may receive one bounty
• Findings may be considered separately if they have distinct root causes or independently exploitable impacts
• Reports of vulnerabilities already known to Varonis may be closed as previously known
• Varonis may link researchers to duplicate reports

Submission Process

Submit one vulnerability per report unless multiple vulnerabilities must be chained to demonstrate impact.

Each report must include:

• A clear description of the vulnerability and affected asset
• Complete, reproducible steps and a working proof of concept
• Any required account access, privileges, configuration, or user interaction
• A realistic attack scenario and demonstrated security impact
• Relevant evidence, such as requests, responses, screenshots, or logs
• The source IP address and testing header used
• Recommended remediation or mitigation, when available

Use only the minimum evidence necessary to demonstrate impact and redact sensitive or unrelated information before submitting.

Reports that are not reproducible, lack sufficient evidence, or do not demonstrate practical security impact may be closed as Not Applicable.

Response Targets

Varonis will make reasonable efforts to meet the response targets for researchers participating in our program:

We will communicate through the HackerOne report and provide meaningful updates as the report progresses through validation, remediation, and retesting.

Response targets are goals rather than guarantees. Complex findings, product-release dependencies, or issues requiring third-party coordination may require additional review.

Varonis Disclosure Policy

Do not publicly disclose vulnerability details, report content, proof-of-concept material, sensitive information, customer information, or remediation details without Varonis' express written approval.

All disclosure requests must be coordinated through the HackerOne report. Follow HackerOne's disclosure guidelines.

Legal Terms and Conditions

You must comply with Varonis' Terms and Conditions, security industry best practices, and all applicable federal, state, local as well as any other laws in connection with your security research activities or other participation in this bug bounty program. You agree that any and all information acquired or accessed as part of this exercise is confidential to Varonis and you shall hold all such information in strict confidence and shall not copy, reproduce, sell, assign, license, distribute, market, transfer or otherwise dispose of, give, or disclose such information to third parties or use such information for any purposes other than as part of your participation in the program described herein or as expressly authorized in writing by Varonis.