At Auth0, Inc., we take security of our users’ data very seriously. If you have discovered or believe you have discovered potential security vulnerabilities in an Auth0 Service, we encourage you to disclose your discovery to us as quickly as possible in accordance with this Responsible Disclosure Program.
We will work with you to validate and respond to security vulnerabilities that you report to us. Because public disclosure of a security vulnerability could put the entire Auth0 community at risk, we require that you keep such potential vulnerabilities confidential until we are able to address them. We will not take legal action against you or suspend or terminate your access to any Auth0 Services, provided that you discover and report security vulnerabilities in accordance with this Responsible Disclosure Program. Auth0 reserves all of its legal rights in the event of any noncompliance.
Capitalized terms not defined in this Responsible Disclosure Program shall have the meaning set forth in our Terms of Use.
We encourage responsible security research on the Auth0 services and products, including Webtask. We allow you to conduct vulnerability research and testing on the Auth0 Services to which you have authorized access. In no event shall your research and testing involve:
The following is a partial list of issues that we ask for you not to report, unless you believe there is an actual vulnerability:
If you believe you have discovered a security vulnerability issue, please share the details with Auth0 by filling the form below.
Auth0 will acknowledge receipt of your report within 2 business days, provide you with an estimated timetable for resolution of the vulnerability, notify you when the vulnerability is fixed, and, with your permission, publicly acknowledge your responsible disclosure.
Email communication between you and Auth0, including without limitation, emails you send to Auth0 reporting a potential security vulnerability, should not contain any of your proprietary information. The contents of all email communication you send to Auth0 shall be considered non-proprietary. Auth0, or any of its affiliates, may use such communication or material for any purpose whatsoever, including, but not limited to, reproduction, disclosure, transmission, publication, broadcast, and further posting. Further, Auth0 and its affiliates are free to use any ideas, concepts, know-how, or techniques contained in any communication or material you send to Auth0 for any purpose whatsoever, including, but not limited to, fixing, developing, manufacturing, and marketing products. By submitting any information, you are granting Auth0 a perpetual, royalty-free and irrevocable right and license to use, reproduce, modify, adapt, publish, translate, distribute, transmit, publicly display, publicly perform, sublicense, create derivative works from, transfer and sell such information.