Kenna Security

About Our Platform

Kenna Security is a leader in risk-based vulnerability management. The Kenna Security Platform enables organizations to measure, prioritize, and predict cyber risk. Kenna leverages Cyber Risk Context Technology™ to track and predict real-world exploitations, focusing security and IT operations teams on what matters most.

---

Special Holiday Bonus!

Considering joining or re-engaging on our bug bounty program?

From now until January 8th, 2021, Kenna Security will be offering a **50% bonus on any submissions with a severity level of P1 or P2

• This is a limited-time bonus, so make sure you submit before 2021-01-08
• Unique and critical level findings will be considered for additional bonuses

---

Researcher Platform Sign-Up:
https://app.us.kennasecurity.com/signup?bugcrowd
DO NOT USE THE KENNA SECURITY SIGNUP PAGE WITHOUT ?bugcrowd IN THE URL.

Older instances hosted on app.kennasecurity.com will be disabled on August 1st, 2020. Please create a new instance on app.us.kennasecurity.com before that date.

Focus Areas:

• Authentication and Authorization weaknesses.
• Cross-account data leakage or unauthorized access
• Stored/Reflected/DOM-based Cross-Site Scripting (XSS)
• SQL Injection (SQLi)
• Server-side Remote Code Execution (RCE)
• Server-side Request Forgery (SSRF)
• Broken access controls (insecure direct object references, etc.)

Out Of Scope:

• Any testing/submissions against Kenna Security customer subdomains is strictly prohibited, not eligible for a reward.
• Distributed Denial of Service and Application Level Denial of Service Attacks.
• Accessible Non-sensitive files and directories (e.g., README.TXT, CHANGES.TXT, robots.txt, gitignore, etc.).
• Social engineering/phishing attacks.
• Self XSS.
• Text injection.
• Email spoofing (including lack of SPF, DKIM, From: spoofing, and visually similar, and related issues).
• Descriptive error messages (e.g., stack traces, application or server errors, path disclosure).
• Clickjacking and issues only exploitable through clickjacking. CSRF issues that don't impact the integrity of an account (e.g., login or out, contact forms and other publicly accessible forms) Lack of Secure and HTTPOnly cookie flags
• Missing HTTP security headers.
• TLS/SSL Issues, including BEAST BREACH, insecure renegotiation, bad cipher suite, expired certificates.
• Out-of-date software.

Third-Party Bugs

If issues reported to our bug bounty program affect a third-party library, external project, or another vendor, Kenna Security reserves the right to forward details of the issue to that party without further discussion with the researcher. We will do our best to coordinate and communicate with researchers through this process.

Coordinated Disclosure Guidelines

We will investigate legitimate reports and make every effort to quickly correct any vulnerability. To encourage responsible reporting, we will not take legal action against you nor ask law enforcement to investigate you provided you comply with the following guidelines:

Coordinated Disclosure Guidelines

• Provide details of the vulnerability, including information needed to reproduce and validate the vulnerability and a Proof of Concept (POC).
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services.
• Do not modify or access data that does not belong to you.
• Give Kenna Security a reasonable time to correct the issue before requesting an update or taking any additional action.