Taboola

Vulnerability Disclosure Policy

Add Comment

Please note: This website includes an accessibility system. Press Control-F11 to adjust the website to the visually impaired who are using a screen reader. Press Control-F10 to open an accessibility menu.Popup headingClose Accessibility<ul> <li>Press enter for Accessibility for blind people who use screen readers</li> <li>Press enter for Keyboard Navigation</li> <li>Press enter for Accessibility menu</li> </ul> <ul> <li>Privacy Policy</li> <li>Cookie Policy</li> <li>Terms of Use</li> <li>Terms of Service</li> <li>Terms and Conditions</li> <li>Vulnerability Disclosure Policy</li> </ul> Vulnerability Disclosure Policy Last Update: June 20th, 2022 Brand Promise Taboola, Inc., together with its affiliates (“Taboola”, “we”, “us”, or “our”) is committed to working with security researchers to verify and address any potential vulnerabilities in our services that are reported to us in accordance with this Vulnerability Disclosure Policy (“Policy”). We hope to foster an open partnership with the security community, and we recognize that the work the community does is important in continuing to ensure the safety and security of our customers, users, and partners. We have developed this Policy to both reflect our corporate values and to uphold our legal responsibility to good-faith security researchers that are providing us with their expertise and security suggestions. Program &amp. Scope We ask that all security researchers submit vulnerability reports about any of the following (collectively, the “Services”): <ul> <li>Our website, www.taboola.com, the websites of our affiliates and subsidiaries (including Connexity and Skimlinks), or any Taboola website displaying our Privacy Policy (collectively the “Sites”)</li> <li>Our content discovery platforms, feeds, widgets, analytics tools, and other technical applications that we provide on third-party websites (collectively, the “Content Discovery Platform”)</li> <li>The Taboola News suite of content-discovery tools available on mobile devices and operating systems (including the Start line of products, collectively “Taboola News”)</li> </ul> Legal Posture We openly accept vulnerability reports for the Services, and Taboola will not engage in legal action against individuals who submit vulnerability reports in accordance with this Policy. We agree not to pursue legal action against individuals who: <ul> <li>Engage in vulnerability testing within the scope of this Policy.</li> <li>Engage in vulnerability testing involving only the Services.</li> <li>Engage in vulnerability testing without affecting or harming Taboola or its customers, users, or partners.</li> <li>Adhere to the laws of their location and the location of Taboola. For example, violating laws that would only result in a claim by Taboola (and not a criminal claim) may be acceptable as Taboola is authorizing the activity (reverse engineering or circumventing protective measures) to improve the Services.</li> <li>Refrain from disclosing vulnerability details to the public before a mutually agreed-upon timeframe expires.</li> </ul> How to Report a Vulnerability Please report the details of any suspected or detected vulnerabilities by submitting a vulnerability report to Taboola’s Security Team at bountyprogram@taboola.com including all the following five (5) elements: Taboola, Inc. 16 Madison Square West, 7th fl. New York, New York 10010 <ul> <li>The date you tested for and found the vulnerability</li> <li>Any steps necessary to reproduce the vulnerability</li> <li>Supporting screenshot(s) in JPEG format (when relevant)</li> <li>A short description of the potential impact</li> <li>The following affirmative statement:</li> </ul> I HAVE READ AND UNDERSTAND AND AGREE TO THE TERMS OF TABOOLA’S VULNERABILITY DISCLOSURE POLICY (“POLICY”). I AGREE TO THE TABOOLA TERMS OF USE. I HAVE COMPLIED AND WILL COMPLY WITH THE RULES OF THE POLICY AND THE TERMS OF USE. I HAVE NOT DISCLOSED THIS SUBMISSION TO ANYONE. I DISCOVERED IT MYSELF. I WILL NOT DISCLOSE THIS SUBMISSION TO ANYONE. Preference, Prioritization, and Acceptance Criteria We will use the following criteria to prioritize and triage submissions. What we would like to see from you: <ul> <li>Well-written reports in English will have a higher chance of resolution.</li> <li>Reports that include proof-of-concept code equip us to better triage.</li> <li>Reports that include only crash dumps or other automated tool output may receive lower priority.</li> <li>Reports that include products not listed under Program &amp. Scope may receive lower priority.</li> <li>Please include how you found the vulnerability, the impact, and any potential remediation.</li> <li>Please include any plans or intentions for public disclosure.</li> </ul> What you can expect from us: <ul> <li>A timely response to your submission (within five business days).</li> <li>After triage, we will send an expected remediation timeline, and commit to being as transparent as possible about such timeline, as well as on issues or challenges that may extend it.</li> <li>An open dialog to discuss issues.</li> <li>Notification when the vulnerability analysis has completed each stage of our review.</li> <li>Recognition after the vulnerability has been validated and resolved. Rewards</li> </ul> We may reward submissions that help keep the Services safe and secure, provided that they adhere to this Policy. Whether a reward is offered or not is at our sole and absolute discretion. <ul> <li>Privacy Policy</li> <li>Cookie Policy</li> <li>Terms and Conditions</li> <li>Modern Slavery Act</li> <li>Israel Equal Pay Report</li> <li>Taboola Blog</li> </ul> Um unsere Webseite für Sie optimal zu gestalten und fortlaufend verbessern zu können, verwenden wir Cookies. Durch die weitere Nutzung der Webseite stimmen Sie der Verwendung von Cookies zu. weitere Informationen Bestätigen Sie