Customer responsibilities:

• Provide explicit written authorization for Bugcrowd and the Security Researchers assigned to work on the Program to conduct penetration testing, including phishing calls, social engineering, and other red team techniques as applicable.
• Clearly define and agree upon the systems, networks, or applications in scope (the “Target Systems”).
• Notify any relevant third-party providers (e.g., cloud service and hosting providers) about the penetration test.
• Terminate/reject or withdraw any take-down requests received from or submitted to third parties in response to authorized penetration testing activities.

Customer responsibilities:

• Mutually agree with Bugcrowd upon specific testing windows, blackout periods, and any critical business times to avoid. Any work rescheduled within three working days of the scheduled start date may incur additional charges.
• Identify and provide contact information for technical and business escalation points.

Bugcrowd commitments:

• Require testing activities to occur only within the agreed-upon testing windows.
• Provide a designated Bugcrowd Technical Pentest Manager (TPM) as primary point of contact.

Customer responsibilities:

• Adequately back up all Target Systems targeted by planned penetration testing prior to commencement of testing.
• In the case of penetration testing activities, notify the Customer security team of the upcoming penetration testing, as they would be the most likely resource to notice any detections or impacts during the testing activities.
• Understand that penetration testing may result in minor system disruption or performance impacts.

Bugcrowd commitments:

• Pursue testing objectives while attempting to minimize impact on system performance and operations during testing.

Customer responsibilities:

• Promptly inform Bugcrowd of any observed operational impact of the testing services during the testing period.

Bugcrowd commitments:

• Adhere strictly to the defined scope.
• Prohibit destructive testing methods, such as Denial-of-Service (DoS) or social engineering, unless explicitly authorized by Customer.
• Log relevant testing activities.

Both parties' responsibilities:

• Establish and provide emergency escalation contacts.
• Agree to immediately pause or terminate testing upon request from either party to mitigate unforeseen risk or operational impact.

Customer rights and usage:

• Customer retains the right to use the penetration test report for internal compliance, auditing, and remediation purposes.

Bugcrowd commitments:

• Provide a final penetration testing report that outlines identified vulnerabilities, risk ratings, and recommended mitigations.
• Offer a secure method of report delivery and optional post-testing debrief session.