1. Application and Scope.

This responsible disclosure addendum (“this RDA”) applies to the submission of any information related to a bug, vulnerability, or other issue (“Vulnerabilities”) related to any Cribl products or services (“Cribl Products”) to Cribl by any person or entity (“Vulnerability Report”). This RDA applies under Cribl’s Standard Terms of Service or other written agreements between you and Cribl that incorporate this RDA by reference (“Applicable Agreements”).

This RDA supplements Applicable Agreements. In the event of a conflict between this RDA and an Applicable Agreement, the terms and conditions of this RDA shall control unless specifically superseded by the terms and conditions provided in an Applicable Agreement.

This RDA does not cover and does not otherwise authorize you to access any products or services of any third party in connection with this RDA, including third-party systems, networks, content, workstations, applications, and data. The safe harbor provided under this RDA does not apply to such third-party products or services.

2. Methodology.

2.1 General Requirements.

You must show that a vulnerability could be exploited, but you cannot exploit the vulnerability. You must use industry standard methods for responsible disclosures and vulnerability discovery and testing. You must use your own test, demo, trial, or developer accounts, and editions of Cribl Products, to which you have access, to discover Vulnerabilities, or when conducting any actions covered by this RDA.

You must be eighteen (18) years of age or older and not employed by Cribl or a spouse of an employee of Cribl. Your submission of a Vulnerability Report or conducting any actions covered by this RDA does not create any employment, partnership, joint venture, or other agency relationship between you and Cribl. This agreement only acts to benefit you and Cribl; it does not act to benefit any third party. You waive all claims, including breach of contract or implied-in-fact contract that may arise related to your submission of a Vulnerability Report or conducting any actions covered by this RDA.

2.2 Prohibitions.

You cannot engage in any kind of denial-of-service or brute force attack, conducting automated vulnerability or penetration scanning against anything other than test accounts, compromise physical security or enter any physical premises, conduct any kind of physical or electronic attack on Cribl’s personnel, system, or facilities, conduct any kind of social engineering against Cribl’s personnel or contractors, access information that does not belong to you, use any access or information except for submitting a Vulnerability Report or conducting any actions covered by this RDA (and in all cases never for any illegal or unethical purpose), destroy or corrupt information that does not belong to you, or any other destructive methods or actions that negatively affect Cribl Products or Cribl’s users. These prohibitions include attempting to do any of these things.

2.3 Reporting.

You must immediately report a vulnerability as soon as you have identified it as a vulnerability. You must also immediately stop testing a vulnerability as soon as you have identified it as a vulnerability.

2.4 Compliance.

You must follow all applicable laws, rules, regulations, contracts, and other legal requirements, including without limitation all requirements described in the compliance addendum available at https://cribl.io/legal/ca; the compliance addendum is incorporated by reference into this agreement. You must comply with all applicable anti-bribery, anti-corruption, and sanctions and prohibited-country requirements and limitations. You must comply with all applicable import and export controls and obtain all licenses and approvals necessary to download, deploy, or use Cribl Products.

You are responsible for any tax implications related to submitting Vulnerability Reports or conducting any actions covered by this RDA as provided by applicable law.

You cannot download, deploy, or use any Cribl Products, or conduct any action covered by this RDA, in any way that violates any legal requirement or right of a third party. You cannot modify Cribl Products, create derivative works from Cribl Products, or reverse engineer any part of any Cribl Products.

You cannot submit Vulnerability Reports or conduct any action covered by this RDA if you are subject to any prohibited-party, export, or trade sanctions or otherwise listed on any sanctions list, including the trade and economic sanctions maintained by the U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”) or other governmental agencies in the United States, the European Union, or other relevant country. This includes being individually subject to such sanctions, being a member of an organization on such a list, or being a resident of any country that is sanctioned by the United States, the European Union, or other relevant country.

2.5 Intellectual Property.

You grant to Cribl a perpetual, irrevocable, worldwide, royalty-free, fully paid-up license to use, copy, adapt, develop, create derivative work from, and disclose any information to any person or entity that you submit, including all information submitted in a Vulnerability Report and any proofs of concept, patches, improvements, suggestions, code samples, and any other information you submit, in connection with addressing, analyzing, remediating, or improving Cribl Products, incorporating that information into Cribl Products, testing, or for any other legitimate business purpose.

Cribl does not grant you any intellectual property rights to any image, information, writing, invention, code, or other information or property created while conducting any actions covered by this RDA. You cannot use Cribl’s trademarks without Cribl’s express written consent.

2.6 Public Disclosure.

You may not publicly disclose information related to a Vulnerability Report to any third party until Cribl has had a chance to address it and provides you with prior written consent. In all cases, you may only publicly disclose information related to validated Vulnerabilities.

3. Submission Process.

Please submit all Vulnerability Reports to Cribl by email at the email address security@cribl.io. In each report, you must include a detailed description of the vulnerability; the URL, IP address, port, or other information needed to locate, identify, and verify the vulnerability; specific steps and other information needed to reproduce the vulnerability and related issues, including screenshots, logs, code, and other information; the methodology you used to identify the vulnerability; your recommendations for remediation steps; the impact you believe would occur if the vulnerability is not remedied; and your full name and contact details.

You must provide your actual name and contact information; screen names and other pseudonyms are not sufficient. You must also provide such personal information and other information as Cribl may require to perform compliance checks.

4. Response.

Cribl will use reasonable commercial efforts to respond to you within 1 business day of receiving a Vulnerability Report. In that response, Cribl will acknowledge receipt of your Vulnerability Report and may provide an estimated time frame for validating identified Vulnerabilities and, if validated, addressing the Vulnerability Report.

Cribl will use reasonable commercial efforts to address Vulnerability Reports within 120 calendar days of receiving a given Vulnerability Report. Cribl will notify you whether Cribl is able to validate identified Vulnerabilities and, for validated Vulnerabilities, when the Vulnerability Report has been addressed.

5. Safe Harbor.

If you submit a Vulnerability Report using the methodology and submission process described in this RDA, and in compliance with all other applicable terms, conditions, and program requirements, Cribl will not pursue civil action or initiate a complaint to law enforcement against you for accessing our systems without authorization to identify that vulnerability.

6. Recognition

If you submit a Vulnerability Report and qualify for the safe harbor provided under this RDA, Cribl may publicly recognize you and your work as described in Cribl’s Responsible Disclosure Program. Cribl will provide no payment or anything of value to you other than the public recognition of your work in consideration for performing under this RDA or otherwise participating in its Responsible Disclosure Program.

7. Other Requirements.

You must also comply with such requirements as Cribl may provide through its Responsible Disclosure Program as described on Cribl’s website, https://cribl.io/security-compliance/, including as to ineligible Cribl Products and ineligible vulnerabilities that may be described by the Responsible Disclosure Program. Cribl may modify or cancel its Responsible Disclosure Program at any time without prior notice or consent.