Datadog Trust Hub

Bug Bounty

Program

Datadog hosts its private Bug Bounty Program with HackerOne. If you’re an independent security expert or researcher and believe you’ve discovered a security-related issue on our platform, we appreciate you disclosing the issue to us responsibly and thank you for your time and expertise.

If you are eligible and want to participate in our private Bug Bounty Program, send us an email at bugbounty@datadoghq.com with your HackerOne username or the email you want an invitation for.

You will report the vulnerability directly in the HackerOne platform and all communication after submission will be conducted there. Before submitting an issue, please read our guidelines and scope of the program.

Eligibility

Datadog employees or contractors—current or former—are not eligible to participate in this program. Please read the complete eligibility requirements before joining the program.

Scope

The scope of the Bug Bounty Program includes Datadog’s products, services, and systems. Vulnerabilities found in vendor systems fall outside of this policy’s scope and should be reported directly to the vendor via their own disclosure programs.

The following describes what systems and types of research are covered under this program. Always be careful to verify whose assets you are testing while performing research.

• Corporate websites:
  • https://www.datadoghq.com
  • https://www.coscreen.co/
  • https://vector.dev/
• Web Applications:
  • https://app.datadoghq.com
  • https://app.cloudcraft.co
• API:
  • https://api.datadoghq.com
  • https://api.cloudcraft.co
• Datadog Mobile App: iOS, Android
• Agent and integrations code (only the latest versions are in-scope)
  • Datadog Agent 7+
  • Datadog Integrations
  • Datadog Docker agent
  • Datadog-official SDKs and libraries - Any of the libraries listed with “Datadog” as the author and marked as “Official”
• Vector agent (only the latest versions are in-scope)
• Coscreen clients (only the latest versions are in-scope)

Rules of Engagement

The following is intended to give security researchers clear guidelines for conducting vulnerability discovery activities to limit the potential for company and/or customer data to be at risk:

• Do add a prefix Bugbounty- to your Datadog org name.
• Do report a potential security issue immediately.
• Do NOT attack other users. If you are testing the ability to access another customer’s data, do not iterate randomly. Create another test account or ask for assistance at bugbounty@datadoghq.com.
• Do NOT attempt Denial of Service (DoS) attacks. If you notice performance interruption or degradation, immediately suspend all testing.
• Do NOT perform any phishing, spamming, social engineering, or other form of fraud on our employees or customers.
• Do NOT perform any physical attacks against Datadog’s property (including workstations, office spaces, servers, or networks) or otherwise try to discover risk beyond digital means against Datadog.
• Do NOT exploit a security issue you discover for any reason other than to validate your finding.
• Do NOT deface any Datadog-associated publicly available resource for a proof of concept (PoC) which explicitly states the vulnerability. For example, for a subdomain takeover PoC, upload a file with hello world in it.

Out-of-Scope Vulnerabilities

Any of the following (or related) activities will be automatically considered out of scope for the Bug Bounty Program:

Application Vulnerabilities:

• Clickjacking or UI redressing (on pages with no sensitive actions)
• Content injection or “HTML injection” unless you can clearly show risk (other than social engineering)
• Cross-Site Request Forgery (CSRF) on features which are available to anonymous users
• Low-impact CSRF including, but not limited to, login, logout, and unauthenticated
• User session duration
• Username/email enumeration
• Same-site scripting and Self-XSS
• Self-exploitation (i.e., password reset links or cookie reuse)
• Missing flags on non-essential session cookies
• Missing security-related HTTP headers which do not lead directly to a vulnerability
• Open redirects on ad/analytics subdomains
• Presence of autocomplete attribute on web forms
• Reflected File Download (RFD) attacks

Data Exposure:

• Banner or version disclosure of server or software
• Information disclosure that has no practical use for exploitation
• Descriptive/verbose/unique error pages (without proof of exploitability)
• Default configuration files which do not disclose sensitive information

Denial of Service:

• Denial of Service (DoS) attacks
• Distributed Denial of Service (DDoS) attacks

End of Life (EoL)/ Outdated Software:

• Any Datadog-developed software that is EoL or no longer supported
• Client side bugs which do not affect (and/or are exploitable on) the latest version of modern browsers
• Outdated dependencies without a working PoC

Physical Security:

• Man-in-the-middle (MITM) attacks or those requiring physical access to the victim’s device
• Physical or social engineering attacks

Security Best Practices:

• Missing SSL/TLS best practices
• Mixed content warnings
• Missing best practices in Content Security Policy
• Missing email security best practices (such as incomplete or missing SPF/DKIM/ DMARC) without a proof of exploitability
• Issues related to networking protocols or industry standards

Miscellaneous:

• Bugs Datadog is already aware of (or ones previously submitted by another researcher)
• Pivoting, scanning, exploiting, or exfiltrating data from internal Datadog systems
• Pervasive issues or vulnerabilities such as heartbleed, meltdown, spectre, or others without a PoC
• Results of automated tools or scanners without a PoC
• Theoretical subdomain takeover claims with no supporting evidence
• Using unreported vulnerabilities to find other bugs
• Vulnerabilities in community-contributed API and DogStatsD client libraries
• Public zero-day vulnerabilities that have had an official patch for less than one month will be awarded on a case by case basis.

Disclosure Policy

The Disclosure Policy of Datadog’s private Bug Bounty Program follows HackerOne’s private program disclosure policy and Datadog’s HackerOne program policy. This program is subject to strict confidentiality requirements. You will need consent from Datadog for any disclosure outside of the program. Prior to accepting an invitation to Datadog’s private program, you should carefully review the program policies and the non-disclosure agreements required for participation.

Report Issues

Report Issues

If you have a security concern, or would like to report suspected platform abuse, please get in touch at security@datadoghq.com and we will promptly get back to you within 24 hours. Our PGP key is available for download in case you need to encrypt communications with us. We request that you do not publicly disclose the issue until we have had a chance to review and address it as necessary.

For inquiries related to known vulnerabilities on our products, please use the vulnerability inquiry request on the Datadog support site.