Responsible Disclosure Program

We appreciate and encourage security researchers to contact us to report potential vulnerabilities identified in any product, system, or asset directly managed by RevOps. If you believe you have identified a potential security vulnerability, please share it with us by following the submission guidelines below. We agree to review any submissions in a timely manner and appreciate researchers assisting us in our security efforts.

*Please note, RevOps does not operate a public bug bounty program and we cannot offer reward or compensation in exchange for submitting issues at this time.

Program Guidelines

Researchers shall disclose potential vulnerabilities in accordance with the following guidelines:

1. Do not engage in any activity that can potentially or actually cause harm to RevOps, our customers, or our employees.
2. Do not engage in any activity that can potentially or actually stop or degrade RevOps services or assets..
3. Do not engage in any activity that violates (a) federal or state laws or regulations or (b) the laws or regulations of any country where (i) data, assets or systems reside, (ii) data traffic is routed or (iii) the researcher is conducting research activity.
4. Do not store, share, compromise or destroy RevOps or customer data. If Personally Identifiable Information (PII) is encountered, you should immediately halt your activity, purge related data from your system, and immediately contact us.
5. Provide RevOps reasonable time to fix any reported issue, before such information is shared with a third party or disclosed publicly.

Once a report is submitted, RevOps commits to provide prompt acknowledgement of receipt of all reports (within two business days of submission) and will keep you reasonably informed of the status of any validated vulnerability that you report through this program.

Out of Scope Vulnerabilities

Certain vulnerabilities are considered out of scope for our Responsible Disclosure Program. Out-of-scope vulnerabilities include:

1. Physical Testing or contact with RevOps customers or employees
2. Social Reverse Engineering. Do not attempt to steal cookies, fake login pages or collect credentials through phishing or social attacks
3. Phishing
4. Denial of Service Attacks
5. Resource Exhaustion Attacks
6. Any attacks that attempt to overwhelm or negatively degrade services for existing customers

Once a report is submitted, RevOps commits to providing prompt acknowledgement of receipt (within two business days of submission). After a report has been acknowledged and confirmed, we will keep you reasonably informed of its status.

Submission Format

When reporting a potential vulnerability, please include a detailed summary of the vulnerability, including the target, steps, tools, and artifacts used during discovery (screen captures welcome).