There are some circumstances where we consider a reported vulnerability ineligible for recognition, either because the feature is working as intended or we accept the low risk as a security/usability tradeoff:  
 

• Submissions without clear reproduction steps or which only include reproduction steps in video form may be ineligible for recognition.
• Anything not directly exploitable, such as:
   
  • Security best practice violations.
  • Email/username enumeration.
  • Missing cookie flags.  
• Vulnerabilities that require an already compromised system such as:
   
  • Jailbreaking a mobile device.
  • Compromised email account.
• Incomplete or missing SPF/DKIM/DMARC records.  
• Clickjacking on pages with no sensitive actions.  
• Attacks where the impact is confined to the attacking user, meaning the effects are limited solely to the individual who initiates the attack (known as self-attacks). 

• We consider security research and vulnerability disclosure activities conducted consistent with this policy as “authorized” conduct under the Computer Fraud and Abuse Act, the DMCA, and other applicable computer use laws such as Cal. Penal Code 502(c). We waive any potential DMCA claim against you for circumventing the technological measures we have used to protect the applications in this vulnerability disclosure program’s scope.  
• We want you to coordinate disclosure through our vulnerability disclosure program, and don’t want researchers to be put in fear of legal consequences because of their good faith attempts to comply with our vulnerability disclosure policy. We cannot bind any third party, so do not assume this protection extends to any third party. If in doubt, ask us before engaging in any specific action you think might go outside the bounds of our policy.  
• Because both identifying and non-identifying information can put a researcher at risk, we limit what we share with third parties. We may provide non-identifying substantive information from your report to an affected third party, but only after notifying you and receiving a commitment that the third party will not pursue legal action against you. We will only share identifying information (name, email address, phone number, etc.) with a third party if you give your written permission.  
• If your security research as part of the vulnerability disclosure program violates certain restrictions in our site policies, the safe harbor terms permit a limited exemption. 

• Do not impact other users with your testing; this includes testing vulnerabilities in repositories or organizations you do not own. If you are attempting to find an authorization bypass, you must use accounts you own.  
• Social engineering, including phishing against employees.  
• Efforts to take over social media pages.
• Attempts to access private customer information or accounts.  
• Attempts to access offices, employee devices, or test physical security controls.
• We recommend using your own email address for any account that you use to perform security research and testing. Clearly identifying accounts that are associated with vulnerability research helps our teams to differentiate between possibly malicious activity and that of researchers involved in our vulnerability disclosure program. Please note that adding your email address does not provide any exemptions to our Terms of Service or permit you to act beyond our program's rules and scope.  
• The following are never allowed and are ineligible for recognition. We may revoke your ability to receive recognition for any reported vulnerabilities and ban your IP address for:  
   
  • Exploiting a vulnerability in any way
  • Performing distributed denial of service (DDoS) or other volumetric attacks  
  • Spamming content  
  • Tools which produce excessive amounts of traffic. Note: We do allow the use of automated tools so long as they do not produce excessive amounts of traffic. For example, running one Nmap scan against one host is allowed, but sending 65,000 requests in two minutes using Burp Suite Intruder is excessive. 

• Personal identifying information (PII) includes:  
   
  • legal and/or full names  
  • names or usernames combined with other identifiers like phone numbers or email addresses  
  • health or financial information (including insurance information, social security numbers, etc.)  
  • information about political or religious affiliations  
  • information about race, ethnicity, sexual orientation, gender, or other identifying information that could be used for discriminatory purposes  
• If you discover PII during your research, please report this vulnerability to Conga immediately. Once this has been reported, you must delete all your local, stored or cached copies of the data containing PII as soon as possible. You must also not share the PII you have discovered with anyone besides Conga, including public disclosure. We may ask you to sign a certificate of deletion and confidentiality agreement regarding the exact information you accessed.
• We may ask you for the usernames and IP addresses used during your testing to assess the impact of the vulnerability. 

Vulnerability submissions should include the following information to be considered for recognition: 
 

• Your full name and email  
• URL for identified vulnerability  
• Vulnerability type  
• Estimated severity (including estimated CVSS Score)
• Written instructions, proof of concept for reproducing the vulnerability  
• Disclosure plans if applicable (post vulnerability remediation/recognition)  

Please note that it may take time to investigate and resolve the issue you have reported.