Sprout Social

  • Points per vulnerability
  • Safe harbor
  • Managed by Bugcrowd

Program stats

186 vulnerabilities rewarded

Validation within 8 days
75% of submissions are accepted or rejected within 8 days

Latest hall of famers

Recently joined this program

Disclosure

Please note: This program does not allow disclosure. You may not release information about vulnerabilities found in this program to the public.

Why Sprout's Bug Bounty?

Sprout Social’s social media management platform will help you find, form and deepen real connections with the people who love your brand. We invite you to test and help secure our primary publicly facing assets. We appreciate your efforts in making SproutSocial more secure, and look forward to working with the researcher community to create a meaningful and successful bug bounty program. Good luck and happy hunting!

Ratings/Rewards:

For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

This program only awards points for VRT based submissions.

Targets

In scope

Target name Type Tags
app.sproutsocial.com Website Testing
  • Website Testing
  • PHP
  • Wordpress
  • MySQL
  • jQuery
app.sproutsocial.com/api API Testing
  • API Testing
  • HTTP
downloads.sproutsocial.com Website Testing
  • Website Testing
media.sproutsocial.com Website Testing
  • Website Testing
sproutsocial.com Website Testing
  • Website Testing
  • PHP
  • Wordpress
  • MySQL
  • jQuery
sproutsocial.com/insights Website Testing
  • Website Testing
  • AWS
  • MySQL
  • Wordpress
  • PHP
  • Amazon Cloudfront
sproutsocial.com/adapt/ Website Testing
  • Website Testing
sproutsocial.com/es/ Website Testing
  • Website Testing
sproutsocial.com/pt/ Website Testing
  • Website Testing
sproutsocial.com/mktapi API Testing
  • API Testing
  • HTTP
Sprout Social for Android Android
  • Mobile Application Testing
  • Android
  • Java
  • Kotlin
Sprout Social for iOS iOS
  • Mobile Application Testing
  • iOS
  • Objective-C
  • Swift
  • SwiftUI
simplymeasured.com Website Testing
  • Website Testing
getbambu.com Website Testing
  • Website Testing
  • PHP
  • Wordpress
  • MySQL
  • jQuery

Out of scope

Target name Type
jobboard.sproutsocial.com Website Testing
Anything that CNAMEs to a third party Other
*.sproutsocial.com/wp-includes Website Testing
sproutsocial.com/wp-includes Website Testing
pagely.sproutsocial.com Website Testing

Out of Scope Submissions

2/11/2020- Moving forward DMARC and SPF records will be considered out of scope

Testing is only authorized on the targets listed as In-Scope. Any domain/property of SproutSocial not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you believe you've identified a vulnerability on a system outside the scope, please reach out to support@bugcrowd.com before submitting.

A note about the targets above

We generally appreciate any bug reports about systems that we use. However, we cannot authorize testing against third parties that we may contract with, and such testing may be in violation of their terms of service. In addition, for anything hosted on AWS, please avoid using network scanners, as this is prohibited by AWS unless you have prior permission (and even then is prohibited in many cases).

There are a few specific exclusions above. Please ensure that you have read and fully understood the target listing above before testing anything.

For new features to test, please see the following:
https://sproutsocial.com/insights/release/


Credentials:

Sprout Social offers a free 30-day trial, so go ahead and make an account (no credit card needed to sign up). Use your @bugcrowdninja.com email addresses when signing up. You may attach your own profiles to those accounts (this may be useful to give yourself more experience with the various parts of the app), or you may attach fake profiles of your choosing. We do not provide test accounts for use.

Researchers testing the mobile applications should note that we do not presently allow new account signups from the mobile apps. New trial accounts may be created on the site from a mobile browser, and subsequently used in the mobile applications.


Safe Harbor:

When conducting vulnerability research according to this policy, we consider this research to be:

  • Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
  • Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;
  • Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and
  • Lawful, helpful to the overall security of the Internet, and conducted in good faith.
  • You are expected, as always, to comply with all applicable laws.

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through this program, or inquire via support@bugcrowd.com before going any further.

Program rules

This program follows Bugcrowd’s standard disclosure terms.

Learn more about Bugcrowd’s VRT.

You may only test against an account for which you are the account owner or an agent authorized by the account owner to conduct such testing.

Sprout Social prohibits the following types of research:


  • Accessing, or attempting to access, data that does not belong to you

  • Executing, or attempting to execute, a denial of service attack

  • Sending, or attempting to send, unsolicited or unauthorized email, spam or other forms of unsolicited messages

  • Testing third party websites, applications or services that integrate with Sprout Social

  • Knowingly posting, transmitting, uploading, linking to, sending or storing any malware, viruses or similar harmful software

  • Research conducted by minors, individuals on sanctions lists or individuals in countries on sanctions lists

To all security researchers who follow this Responsible Disclosure Policy, Sprout Social promises to:


  • Acknowledge receipt of your report in a timely manner

  • Provide an estimated time frame for addressing the vulnerability

  • Notify you when the vulnerability is fixed

  • Publicly acknowledge your responsible disclosure, if you wish

Please do not publicly disclose vulnerability details without express written consent from Sprout Social.