<div class="component">
<h1>Podium Vulnerability Disclosure Policy v.1</h1>
<h2>Introduction</h2>
Podium is committed to ensuring the security of its users by protecting their information. This policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us.
&nbsp;
This policy describes what systems and types of research are covered under this policy and how to send us vulnerability reports.
&nbsp;
We encourage you to contact us to report potential vulnerabilities in our systems.
<h2>Safe Harbor</h2>
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
<h2>Guidelines</h2>
Here are some general guidelines for researchers looking into our environment:
<ul>
<li style="font-weight: 400;" aria-level="1">Respect the privacy of user accounts. Do not excessively access information that is not relevant to your test. Use test accounts or data wherever possible.</li>
<li style="font-weight: 400;" aria-level="1">Do not disclose a vulnerability to non-Podium personnel without Podium’s explicit written consent.</li>
<li style="font-weight: 400;" aria-level="1">If access is gained into an internal system, do not use that access to pivot and explore other internally accessible services. For the purposes of your report, ending reproduction steps at this point will be sufficient enough for our team to triage and appropriately assess severity.</li>
<li style="font-weight: 400;" aria-level="1">Do not go beyond what is necessary to prove a vulnerability exists.</li>
<li style="font-weight: 400;" aria-level="1">Do not take any action that could impact the performance or availability of our services — be mindful when using automated scanners and tools.</li>
<li style="font-weight: 400;" aria-level="1">Never save or make copies of private data from Podium services.</li>
</ul>
<h2>In-Scope</h2>
Assets:
<ul>
<li style="font-weight: 400;" aria-level="1"><a href="https://accounts.podium.com">https://accounts.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://black-mamba.podium.com">https://black-mamba.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://magic.podium.com">https://magic.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://payments.podium.com">https://payments.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://review-rocket.podium.com">https://review-rocket.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://auth.podium.com">https://auth.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://link.podium.com">https://link.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://mobile-api.podium.com">https://mobile-api.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://operator.podium.com">https://operator.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://vader.podium.com">https://vader.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://anakin.podium.com">https://anakin.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://weezing.podium.com">https://weezing.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://app.podium.com">https://app.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://orwell.podium.com">https://orwell.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://pay.podium.com">https://pay.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://assets.podium.com">https://assets.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://mind-flayer.podium.com">https://mind-flayer.podium.com</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://play.google.com/store/apps/details?id=com.ionicframework.ionicapp410897&amp;hl=en_US&amp;gl=US">https://play.google.com/store/apps/details?id=com.ionicframework.ionicapp410897&amp;hl=en_US&amp;gl=US</a></li>
<li style="font-weight: 400;" aria-level="1"><a href="https://apps.apple.com/us/app/podium-interaction-platform/id971412288">https://apps.apple.com/us/app/podium-interaction-platform/id971412288</a></li>
</ul>
&nbsp;
<h2>Out-of-Scope</h2>
Assets:
<ul>
<li style="font-weight: 400;" aria-level="1"><a href="https://www.podium.com">https://www.podium.com</a> &#8211; Our main marketing website, it is an externally hosted WordPress site</li>
<li style="font-weight: 400;" aria-level="1">*.podium.com &#8211; This is to cover any subdomain that is not outlined above in the section titled “In-Scope”</li>
</ul>
&nbsp;
When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
<ul>
<li style="font-weight: 400;" aria-level="1">Rate limiting or bruteforce issues on any endpoints</li>
<li style="font-weight: 400;" aria-level="1">Attempts to access our offices or data centers</li>
<li style="font-weight: 400;" aria-level="1">Attacks requiring phishing as a main attack method (can by ignored on case-by-case basis)</li>
<li style="font-weight: 400;" aria-level="1">Attacks where spamming a customer is the primary impact</li>
<li style="font-weight: 400;" aria-level="1">Vulnerabilities in a vendor we integrate with</li>
<li style="font-weight: 400;" aria-level="1">Pages prone to Clickjacking</li>
<li style="font-weight: 400;" aria-level="1">Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions</li>
<li style="font-weight: 400;" aria-level="1">Attacks requiring MITM or physical access to a user&#8217;s device.</li>
<li style="font-weight: 400;" aria-level="1">Previously known vulnerable libraries without a working Proof of Concept.</li>
<li style="font-weight: 400;" aria-level="1">Comma Separated Values (CSV) injection without demonstrating a vulnerability.</li>
<li style="font-weight: 400;" aria-level="1">Missing best practices in SSL/TLS configuration.</li>
<li style="font-weight: 400;" aria-level="1">Any activity that could lead to the disruption of our service (DoS).</li>
<li style="font-weight: 400;" aria-level="1">Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS</li>
<li style="font-weight: 400;" aria-level="1">Missing best practices in Content Security Policy.</li>
<li style="font-weight: 400;" aria-level="1">Missing HttpOnly or Secure flags on cookies</li>
<li style="font-weight: 400;" aria-level="1">Improper scope on session cookies</li>
<li style="font-weight: 400;" aria-level="1">Expiration time on session cookies being too generous</li>
<li style="font-weight: 400;" aria-level="1">Session does not immediately invalidate on logout / password change</li>
<li style="font-weight: 400;" aria-level="1">Missing Anti-CSRF protections</li>
<li style="font-weight: 400;" aria-level="1">Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)</li>
<li style="font-weight: 400;" aria-level="1">Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]</li>
<li style="font-weight: 400;" aria-level="1">Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).</li>
<li style="font-weight: 400;" aria-level="1">Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.</li>
<li style="font-weight: 400;" aria-level="1">Out of date libraries / packages, unless the library / package can be leveraged into a different vulnerability inside the context of the application</li>
<li style="font-weight: 400;" aria-level="1">Tabnabbing</li>
<li style="font-weight: 400;" aria-level="1">Open redirect &#8211; unless an additional security impact can be demonstrated</li>
<li style="font-weight: 400;" aria-level="1">Issues that require unlikely user interaction</li>
</ul>
&nbsp;
<h2>Bug Bounty Program</h2>
At this time, Podium’s Bug Bounty Program is in Private, invite-only mode and is not yet ready for public participation. 
&nbsp;
We do believe that a valid report submitted in compliance with this policy which is in-scope and requires code change deserves monetary compensation. Once the security team has had time to review your report and it is determined that it is a valid report in line with our Bug Bounty Program, we will reach out to you for your contact information to get you added to our private program.
&nbsp;
We ask that at this time, you submit your findings through this process first and have the Security team invite you to the Bug Bounty Program rather than withholding your report until an invite is received. We follow this process as a way to vet out-of-scope, erroneous reports and can guarantee you that if your report leads to significant code change; we will invite you to our program and provide a reward.
<h2>Reporting Process</h2>
If you believe that you have a finding to disclose, please submit your report to <a href="mailto:security@podium.com">security@podium.com</a> with the header: VDP Report &#8211; VULN_TYPE followed by the reproduction steps.
&nbsp;
The security team will acknowledge receipt of the report within 3 business days. After assessing the validity of your report, we will respond with next steps (whether it is valid or invalid).
&nbsp;
We do not support PGP-encrypted emails at this time.
</div>