Responsible Disclosure Policy

At Sprout Social™, we take the security of our users' data very seriously. We encourage those who have discovered potential security vulnerabilities in a Sprout Social™ service to disclose it to us in a responsible manner.

We will work with security researchers to validate and respond to vulnerabilities that are reported to us. We won't take legal action against or suspend or terminate your account access provided you discover and report security vulnerabilities in accordance with this Responsible Disclosure Policy. Sprout Social reserves all of its legal rights in the event of any noncompliance.

Testing for security vulnerabilities

You may only test against an account for which you are the account owner or an agent authorized by the account owner to conduct such testing.

Sprout Social™ prohibits the following types of research

• Accessing, or attempting to access, data that does not belong to you
• Executing, or attempting to execute, a denial of service attack
• Sending, or attempting to send, unsolicited or unauthorized email, spam or other forms of unsolicited messages
• Testing third party websites, applications or services that integrate with Sprout Social™
• Knowingly posting, transmitting, uploading, linking to, sending or storing any malware, viruses or similar harmful software
• Research conducted by minors, individuals on sanctions lists or individuals in countries on sanctions lists

Reporting potential vulnerabilities

Share the details of any suspected vulnerabilities with the Sprout Social™ Security Team by sending an email to [email protected]. Please do not publicly disclose these details without express written consent from Sprout Social™. In reporting any suspected vulnerabilities, please include the following information:

• Exploit details with adequate information to allow us to reproduce your steps
• Your email address
• Your name as it should be displayed on this page if you would like it to be
• Your Twitter handle if you would like it displayed next to your name, on this page

No compensation

Sprout Social™ does not compensate individuals or organizations for identifying potential or confirmed vulnerabilities. Requests for monetary compensation will be deemed in violation of this Responsible Disclosure Policy.

Sprout Social's commitment

To all security researchers who follow this Responsible Disclosure Policy, Sprout Social™ promises to:

• Acknowledge receipt of your report in a timely manner
• Provide an estimated time frame for addressing the vulnerability
• Notify you when the vulnerability is fixed
• Publicly acknowledge your responsible disclosure, if you wish

Thanks!

Sprout Social™ thanks the following individuals and organizations that have participated in our responsible disclosure program.

• Muhammad Waqar – @MuhammadWaqar_9
• Rafay Baloch – @rafaybaloch
• Saqib Kamran – @saqibkamran
• Tom Van Goethem – @tomvangoethem
• Kamil Sevi – @kamilsevi
• Francisco Correa – @panchocosil
• Vedachala – @vedachalaka
• Himanshu Sharma – @s3curity.net
• Jay Turla – @shipcod3
• Mahadev Subedi – @blinkms
• Nikhalesh Singh Bhadoria – @nikhaleshsingh
• Ajay Singh Negi – @AjaySinghNegi
• Team Defencely – @Defencely
• Jigar @ Infobit – @jigarthakkar39
• Frans Rosén – @detectify
• Shahee Mirza – @shaheemirza
• Sunil Dadhich – @Sunil_Dadhich7
• Issam Rabhi – @IssRabhi
• Krutarth Shukla – @KrutarthShukla
• Javid Hussain – @javidhussain21
• Siddhesh Gawde – @pen3t3r
• Nitesh Shilpkar – @NiteshShilpkar
• Denis Kolegov – @dnkolegov
• Ravindra Singh Rathore – @ravindra_hacks
• Vinesh N. Redkar – @b0rn2pwn
• Devesh Bhatt – @deveshbhatt11
• Sebastian Neef – @internetwache
• Muhammad Shahmeer (Maads-Security) – @Shahmeer_Amir
• Rishiraj Sharma – @ehrishiraj
• Florin – @QuisterTow
• J Muhammed Gazzaly – @gazly
• Jose Pino – @Fr4phc0r3
• Mayank Kapoor – @wHys0SerI0s
• Gurjant Singh – @GurjantSadhra
• Sujoy Chakravarti – @sujoy3188
• Divakar – Divakar
• Ketan Sirigiri – @cigniti
• Daniel Alvear – @Mazt0r
• Gineesh George – @g1n1_influenza
• Evan Ricafort – @robinhood0x00
• Tony Trummer – @SecurityGlitch
• Paul Biteng – @PaulBits
• Ali Hassan Ghori – @alihasanghauri
• Blessen Thomas – @pentagramz
• Lyon Yang – @l0Op3r
• Ahmed El-Mahalawy – @A7medElMa7alawy