Collibra

Program Details

Bug bounty program rules for the data governance platform. Vulnerabilities are disclosed confidentially through a submission form, and rewards run from USD10 to USD500 per vulnerability, set by severity at Collibra's sole discretion. Finding the same bug on a further unique path before payout earns an extra 5% per path.

Allows Disclosure

No

Rules & Testing

Out of Scope

The bug bounty submission form itself, Missing best practices in DNSSEC configuration, IP brute force attacks, SSO related vulnerabilities, Clickjacking on pages with no sensitive actions, Unauthenticated, logout or login CSRF, Assets or resources prefixed with "console-", DNS removal of subdomains that do not point to an active service, Attacks requiring MITM or physical access to a user's device, Previously known vulnerable libraries without a working proof of concept, CSV injection without a demonstrated vulnerability, Missing best practices in SSL/TLS configuration, Third party service provider issues, Issues already known to Collibra or reported by someone else first

security.txt expired

Contact

https://www.collibra.com/security-requests, https://www.collibra.com/us/en/contact-us

Policy

https://www.collibra.com/us/en/legal/documents/collibra-bug-bounty-program-rules

Hiring

https://www.collibra.com/us/en/company/careers

Expires

Dec 31, 2025