Information security is paramount at Globality.

• You can’t access or attempt to access anyone else’s data.
• You can’t destroy or corrupt (or attempt to) any data, system, or infrastructure component.
• You can’t perform any attack that could harm the reliability/integrity of our services, such as DDoS or spam attacks.
• If you find a bug, do not disclose it to anyone but us. Do not post it anywhere until we fix it.
• You may only test for vulnerabilities on sites owned and operated by Globality.
• You may not impact any of our users while doing your tests.
• Nontechnical attacks (phishing, social engineering, physical attacks, etc.) are prohibited and ineligible for rewards.
• You may not test any website forms (including lead and message forms). Such tests are automatically disqualified.
• If you have any questions, concerns, or doubts, please contact us by submitting the form above.

• We will respond to your query/report as quickly as possible, usually within 24 hours.
• We will update you on what we find and what we are going to do about it.
• As long as you follow and abide by our rules, we will not engage in litigation against you.
• If we determine that your finding is original and meaningful and has impact and if you followed all our rules, we will reward you.

• Bugs that don’t affect the latest version of modern browsers or bugs related to browser extensions
• Reports that don’t include detailed steps to reproduce the issue
• Insecure cookie settings for nonsensitive cookies
• Bugs relating to the disclosure of public information or information that does not present significant risk
• Bugs that have already been submitted by another user or that we are already aware of
• Bugs in content/services that are not owned/operated by Globality, including our third-party providers, cloud hosting services, and other vendors (unless such bugs allow access to our data)
• Automation attacks or brute forcing of any information, including usernames and passwords
• Session termination, password reset requests, input validation and rate limiting on any contact forms. Exposed JS or HTML files.
• Reports about email spoofing or email flooding via web forms.

Discreetly share full details of the suspected vulnerability with us by sending an e-mail to bugbounty@globality.com.

Include the following information:

• A full description of the issue you discovered, including exploitation methodology and impact
• Type of issue (cross-site scripting, buffer overflow, SQL injection, etc.)
• Proof of concept and/or details of a URL demonstrating the issue
• Details about any unique configuration required to reproduce the issue

Globality will review your report and confirm that your finding is original, meaningful, impactful, and that you followed all of our rules. A Globality team member will contact you to disclose our decision and arrange payment of the monetary reward determined by the team. Our typical range of rewards is $250 to $10,000.

• Actions that may result in danger to the health and/or safety of people or damage to the environment
• Violations of Globality’s security policies
• Disclosing confidential and/or personal information to unauthorized parties
• Abuse of Globality’s equipment or information systems
• Inappropriate conduct by a manager, supervisor, or other person with authority
• Criminal offenses, including fraud, bribery, corruption, and money laundering
• Conflicts of interest
• Anticompetitive behavior
• Failure to comply with any legal obligation
• Misuse of company assets, including unethical practices in finances, internal accounting controls, financial reporting, and auditing matters
• Any other legal or ethical concern
• Concealment of any of the above

• Any employee, contractor, customer, or any other interested party can file a report.
• Reports can be filed anonymously.
• Globality will make no effort to discover the identity of the reporter.
• Globality will never retaliate against anyone who made a report in good faith.*
• Globality will investigate each report to the best of its ability.
• Reports and investigation results will be shared with the executive team.

* Unless the person making the report implicated themselves in illegal or unethical activity