Cybozu Bug Bounty Program
Cybozu Bug Bounty Program
We will pay a reward as a token of our gratitude for those who discover and report vulnerabilities in our applicable Products.
The maximum reward per vulnerability is 2,000,000 yen.
[Important] Temporary Suspension of the Bug Bounty Program
We have temporarily suspended the acceptance of new bug bounty submissions while we review our Bug Bounty Program.
To help improve the security of our products and services, vulnerability reports can still be submitted through our standard Vulnerability Reporting Form.
Please note that vulnerability reports submitted during the suspension period will not be eligible for bug bounty rewards.
Program Overview
How to Participate in the Program and Report Vulnerabilities
If you would like to participate in the Bug Bounty Program, please report a vulnerability using the
Reporting Site.
You will need an account to report a vulnerability on the Reporting Site. Please click Account
Request below to request one.
Please note that any reports made outside the Reporting Site will not be eligible for the reward
payment. For reporting a vulnerability, please access the Vulnerability Report page.
Participation Requirements
Anyone can participant as long as they fulfill the following requirements:
-
You are not an employee of Cybozu or its subsidiary companies as of the time of reporting.
-
You don't work for Cybozu or its subsidiary companies as of the time of reporting under a contract such as a work delegation agreement, secondment agreement, dispatching agreement or the like.
-
You have not been employed as regular fulltime employees of Cybozu or its subsidiary companies in the past year.
-
You have not worked in the product development and cloud service operation related work at Cybozu or its subsidiary companies in the past year.
-
You can communicate with Cy-PSIRT in Japanese or English.
-
You can provide equipment available to access a tested environment. There are no restrictions on what kind of equipment can be used.
-
You agree with the terms and conditions.
Restrictions and Prohibitions
If you interfere with the operations of our services, we may take measures such as blocking their access to our services without any prior warning, thereby restricting its participation in the program in the future. For details, please confirm to Article 6 “Restrictions and Prohibited Matters” of the terms.
1. Prohibition of Testing in Environments Not Covered by Cybozu Bug Bounty Program
Vulnerability testing is prohibited for the products, Web sites, and domains that are not listed in "Scope". Furthermore, vulnerability testing for our cloud products is only allowed for (subdomain).cybozu-dev.com.
2. Function in Which Security Testing Is Prohibited
"Contact Us" function of cybozu.com Administration
3. Load Testing Is Prohibited
You cannot perform testing that puts a considerable load on the environment.
Vulnerability Testing Environment Program
We provide the " vulnerability testing environment program" so that you can conduct tests safely without considering any impact on the production environment. Please refer to the following page for details.
Scope
Products and Services
For more information about one of our products or services, please refer to that product or service’s help site.
- * Use the URL provided in “Test environment URL” to access the applicable service.
- * Please note that you are prohibited from conducting testing related to customer environments with URLs formatted as https://*.cybozu.com.
- * Use the URL above to download the applicable service.
About Private Program
We will invite some participants to "private program" that we will allow testing products that are not covered by regular program or under conditions that differ from regular rules.For details, we will only contact each private program participant individually. Please note that we will not disclose the details to anyone other than the participants.
Out-of-Scope Products, Services, and Websites
A product, service or website is out of scope if it is not listed in the section “Scope: Products and Services.”
Rewards
Products and Services
We determine the reward amount based on the vulnerability type.Note that information on how much reward a reporter receives is not disclosed to anyone other than the reporter.For details, refer to "Cybozu Bug Bounty Program Rulebook".
- (*1) Includes APIs provided by each product
For details on how to judge vulnerability information in Cybozu Bug Bounty Program, see "Vulnerability Identification Guidelines".
Web Sites
- RCE:
- 1,000,000 yen （flat rate）
- Others:
- 20,000 yen （flat rate）
Rewards for vulnerabilities found on Web sites are calculated by applying the fixed rate described above even when the vulnerability is found in CGI, JavaScript, or other programs. For a list of applicable Web sites, see the tables above in the section "Scope".
Contact us
Frequently Asked Questions (FAQ)
Please check the frequently asked questions and answers before contacting us.
Contact Us
You can contact us at the Reporting Site with any questions or requests regarding the Bug Bounty Program.
If you do not have an account, please contact us using the form below.
https://cy-psirt.form.kintoneapp.com/public/inquery
