# Responsible Disclosure Policy

### **Overview**

At Carta we are committed to keeping our customers' data secure and private. We take security seriously and to demonstrate that security is a priority to us we ensure that our Responsible Disclosure Policy allows the independent security researchers an opportunity to engage with us and notify us of potential security threats impacting the safety of our customers' data. If you believe you have discovered a potential vulnerability that affects our services, please, let us know.

For any activity you conduct in accordance with the Responsible Disclosure Policy guidelines below, Carta will not take legal actions against you.

### **General Policy Guidelines**

- Do not disclose the potential security issue to any third party including, but not limited to social media outlets without Carta's prior written permission.
- Do not engage or perform any form of attacks that could harm the availability, integrity, or confidentiality of our service.
- Do not engage in any form of spamming or phishing of our customers or potential customers.
- Do not engage in any form of social engineering against Carta employees, customers, or infrastructure.
- Do not engage in acts of intimidation or extortion.
- Do not violate the privacy of others, disrupt our systems, destroy data, and/or harm the user.
- If a vulnerability provides unintended access to data: cease testing and submit a report immediately (e.g., if you encounter any user data during testing, such as personal information or proprietary information)
- Submission of a report does not create an employment, or agency relationship between you and Carta.
- You're prohibited from participating in the program if you are a resident of any U.S. embargoed jurisdiction, including but not limited to Iran, North Korea, Cuba, the Crimea region, and Syria; or if you are on the U.S. Treasury Department's list of Specially Designated Nationals or the U.S. Department of Commerce Denied Persons List. By participating in the program, you represent and warrant that you are not located in any such country or on any such list.
- Payment of any reward is made at Carta's sole discretion.
- When in doubt, please email [security@carta.com](mailto:security@carta.com).
- Carta may modify this policy from time to time.

### **Reporting Guidelines**

Do provide sufficient information to reproduce the problem, so we will be able to resolve it as quickly as possible. Please, fill out the form at the bottom of the page so we can intake and review your submission.

We will investigate any details you provide and respond as soon as possible, usually within three business days, and will keep you reasonably informed of the status of any validated vulnerability that you report through this program.

# Submission form

All fields are required unless marked optional.

## Summary title

Help us get an idea of what this vulnerability is about.

Submission title

## Technical severity

The [Vulnerability Rating Taxonomy](https://bugcrowd.com/vulnerability-rating-taxonomy) is the baseline guide used for classifying technical severity.

VRT Category

Select or search for a vulnerability type

VRT Subcategory (optional)

VRT Variant (optional)

## Vulnerability details

URL / Location of vulnerability (optional) For example: `https://secure.server.com/some/path/file.php`

Description

Describe the vulnerability and its impact.

Provide a proof of concept or replication steps.

Maximum 25,000 characters.

Write in MarkdownPreview Markdown

Embed images by dragging & dropping, selecting, or pasting them. [Markdown supported](https://bugcrowd.com/markdown-help)

## Attachments (optional)

Attach proof-of-concept scripts, screenshots, screen recordings, etc.

Add attachments

You can attach up to 20 files. Please keep individual upload size under 400MiB.

You can embed attachments (.jpg/.gif/.png, smaller than 5MB) into the Markdown fields. You can copy the embed code using the ‘Copy as Markdown’ button.

## Email

By providing your email address you can claim your submission on [bugcrowd.com](https://bugcrowd.com/).

Note: Submissions through this form are welcome. However, if you have been removed from the Bugcrowd platform or this customer’s engagements by the Platform Behavior Standards team:

- Your submission will still be **reviewed**.
- It **cannot be claimed on the platform**.
- You will **not receive points, compensation, or accuracy increases** for this work.

This form is intended solely for anonymous ethical disclosure and cannot be used to bypass removals.

Researcher email (optional)

## Confirmation

Confirm your submission is accurate and adheres to **[Bugcrowd’s terms & conditions](https://www.bugcrowd.com/resource/standard-disclosure-terms/)**.

I agree to **Bugcrowd’s terms & conditions** as well as any additional rules and instructions provided by the organization hosting this program.