Bug Bounty Program

We welcome and appreciate the assistance of the global security community in helping us keep our systems and tools safe.

DataChain puts a lot of effort into keeping its systems, platforms and tools as secure as possible. Yet, we understand that no matter how much effort we put into system security, bugs and accidents can happen and security vulnerabilities can always be discovered in our products.

Thus, we welcome and appreciate the assistance of the global security community in helping us keeping our systems and tools safe.

Responsible Disclosure Policy

We appreciate responsible disclosure of security bugs & vulnerabilities, and encourage a reporting process which involves collaborating with us to address the issue. This document details our stance on externally reported security issues in our products (open and closed source) and infrastructure.

If you discover a vulnerability, we would like you to inform us as soon as possible so we can take appropriate action as quickly as possible.

Guidelines

  • Email your findings to [email protected].
  • Provide sufficient information to reproduce the problem. Those are critical for us to understand it & assess its impact so we will be able to resolve it as quickly as possible.
  • Do not take advantage of the vulnerability or breach you have discovered. For example, by downloading more data than necessary to demonstrate the vulnerability, or deleting or modifying other people's data.
  • Do not disclose the bug/vulnerability to others until it has been resolved by us and confirmed. We take all reports extremely seriously and will get back to you as soon as possible.
  • Out of concern for the availability of our services to all users, please do not attempt to carry out DoS attacks, leverage black hat SEO techniques, spam people, employ social engineering, carry attacks on physical security systems or perform other similarly questionable actions. Whenever possible, please try to test the vulnerabilities locally without impacting other users. We also discourage the use of any vulnerability testing tools that automatically generate significant volumes of traffic.
  • If you have created a Studio account for security research purposes, please send us the account name and email you used.

We promise

  • To respond to your report within 3 business days.
  • To respond with our evaluation within 7 business days.
  • If you followed the instructions above, we will not take legal action against you in regard to your report. We would adhere to GitHub's Safe Harbor Policy.
  • We will handle your report with strict confidentiality and will never pass on your personal details to third parties without your permission.
  • We will keep you informed of the progress towards resolving the problem.
  • If the vulnerability was reported on an open source product - we will, with your approval, publicly disclose it on the repo and give credit to you for uncovering it!

Rewards

We appreciate your help in keeping our systems safe. Depending on the vulnerability being reported, we may offer a reward for reporting it.

Typical rewards are bounties of up to 100 USD for low severity vulnerabilities, with higher bounty amounts for more severe issues. The specific reward for a given vulnerability is at our discretion.

We will not award a bounty for vulnerabilities that:

  • Are found in a manner not conforming to our responsible disclosure guidelines.
  • Are already known to us.
  • Have negligible security impact or cannot be proven to be exploitable.
  • Are related to DataChain owned domains (see Scope) and deal with:
    • HTTPS configuration, including supported TLS versions & cipher suites
    • HTTP headers, for purposes including Strict Transport Security, Content Security Policy, and clickjacking/XSS protection
    • DNS records including those related to email (SPF, DKIM, DMARC) and certificate issuance (CAA)
  • Are unconfirmed reports from automatic vulnerability scanners.
  • Are related to rate limits or brute force attacks.
  • Only demonstrate the ability to infer versions of software that we run (banner grabbing).
  • Are found in services that are out of scope.
  • Are found in our open source tools and are of low severity.

We will pay out bounties to any individual permissible under California law. Bounties will always be paid out to a single individual and not to a group of people.

Scope

The bounty program covers all DataChain's tools and infrastructure, including:

Vulnerabilities in Open Source Projects

We develop and maintain open source tools - like datachain - and take pride in our open source culture and community.

For open source code, most bugs and issues (non-vulnerabilities) should be openly and publicly reported to us and the community using GitHub issues on the respective repository. That means that those are excluded from the bounty program, and opening a public issue is the only thing for you to do for a responsible disclosure.

However, if there is any concern of a security risk in your finding, and you believe you've found a security vulnerability in one or more of our open source tools, we ask that you report it to us first, privately, using the guidelines below, the same way that you would a closed-source or infrastructure vulnerability. This is in direct interest of our users and community - public disclosure dramatically raises the chance of vulnerability abuse.

As per our bounty terms we may choose to not reward low severity vulnerabilities - in such cases, and per our discretion only (if we deem it safe), we may approve opening a public issue detailing the finding - making it visible, and giving credit to the reporter.

After the vulnerability was addressed, and only with our approval, the issue can be disclosed publicly. This can happen in the form of an issue on the public repository, or any additional public channels per our discretion.

Vulnerabilities in third-party systems

Third-party systems and services that are not part of our tools' dependencies / supply chain, are out of scope. This includes source code management systems (e.g. GitHub), CI/CD systems, package managers, etc. We cannot authorize you to conduct security research of assets that belong to other users and companies on their behalf.

That said, we do welcome submissions describing vulnerabilities in our configuration, integration or usage of those third-party services.

The list of third-party services includes, but is not limited to:

Vulnerabilities in Third-Party Dependencies

A critical element of the security of a software package is the security of its supply chain and dependencies. Given that, vulnerabilities in third-party dependencies are in scope for this program.

That said, please send your bug reports directly to the owner of the vulnerable package first and ensure that the issue is addressed upstream before letting us know of the issue details.

Just like we would like to learn about vulnerabilities in our code first, we feel third-party code authors should have the same advantage.

Submissions detailing vulnerabilities through third-party dependencies should:

  • Demonstrate that the vulnerability manifests itself in our projects (i.e. you must show that the third-party vulnerability can be triggered or exploited in our systems or tools).
  • Be shared no earlier than 90 days after the issue was fixed & released upstream (e.g. a patched software package was released).

Vulnerabilities in third-party services or platforms used to maintain and build DataChain software are out of scope for this program.

This policy was originally adapted from:

Add the missing data context layer to your object storage.

Book a Callpip install datachain