Responsible Disclosure Policy

At Sprout Social™, we take the security of our users' data very seriously. We encourage those who have discovered potential security vulnerabilities in a Sprout Social™ service to disclose it to us in a responsible manner.


We will work with security researchers to validate and respond to vulnerabilities that are reported to us. If you discover a security vulnerability and report in accordance with this Responsible Disclosure Policy, we will not take legal action or terminate your account access. Sprout Social reserves all of its legal rights in the event of any noncompliance.


Testing for Security Vulnerabilities


You may only test against an account for which you are the account owner or an agent authorized by the account owner to conduct such testing.


Sprout Social™ Prohibits the Following Types of Research:

  • Accessing, or attempting to access, data that does not belong to you
  • Executing, or attempting to execute, a denial of service attack
  • Sending, or attempting to send, unsolicited or unauthorized email, spam or other forms of unsolicited messages
  • Testing third party websites, applications or services that integrate with Sprout Social™
  • Knowingly posting, transmitting, uploading, linking to, sending or storing any malware, viruses or similar harmful software
  • Research conducted by minors, individuals on sanctions lists or individuals in countries on sanctions lists

Reporting Potential Vulnerabilities


Please share the details of any suspected vulnerabilities with the Sprout Social Security Team by submitting a report through our Bugcrowd Program.  If your report is outside the scope of our Bugcrowd program, please send an email to security@sproutsocial.com.

Please do not publicly disclose these details without express written consent from Sprout Social™. In reporting any suspected vulnerabilities, please include adequate information to allow us to reproduce your steps and follow up.


No Compensation


Sprout Social™ does not compensate individuals or organizations for identifying potential or confirmed vulnerabilities. Requests for monetary compensation will be deemed in violation of this Responsible Disclosure Policy.


Sprout Social’s Commitment


To all security researchers who follow this Responsible Disclosure Policy, Sprout Social™ promises to:

  • Acknowledge receipt of your report in a timely manner
  • Provide an estimated time frame for addressing the vulnerability
  • Notify you when the vulnerability is fixed
  • Publicly acknowledge your responsible disclosure, if you wish

Thanks!


Sprout Social™ thanks the following individuals and organizations that have participated in our responsible disclosure program.