By participating in this program, you agree to:

• Respect the Community Code of Conduct
• Respect the Intigriti Terms and Conditions
• Respect the scope of the program
• Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)

Validation times

We will validate all submissions within the below timelines, once your submission has been verified by Intigriti.
Submissions validated outside of this may be awarded a €25 bonus.

This remains at the discretion of Grafana to award.

Check our fix
We offer up to €50 bonus to verify a resolved issue for us (when requested).
This remains at the discretion of Grafana to award.

Terms and Conditions

1. Participants must follow the following guidelines in order to be eligible to receive any payouts pursuant to this Program:
   • Only testing of In-Scope products detailed in the section titled “Scope” is allowed;
   • Do not disclose any issue publicly before a fix has been released by Grafana Labs (even if you have already received the reward);
   • Participants may at no time disrupt any Grafana Labs service;
   • Participants may not access any accounts or data other than their own;
   • Do not post attachments or Proof Of Concepts (POCs) on a 3rd party website, instead participants must include them in the report;
   • Participants must comply with all applicable laws;
   • Submissions must be made in English;
   • All actions must be performed strictly during participation in the Program and in adherence with this Policy; and
   • All actions must be performed as good faith security research, with the intent to report to Grafana Labs
2. All payouts made pursuant to this policy shall be calculated and paid at the sole discretion of Grafana Labs. All payments made by Grafana Labs are final and binding. Participants in this program shall be solely responsible for the payment of all applicable taxes.
3. In order to receive their payouts, participants will need to submit personal information to Intigriti.
4. Grafana Labs reserves the right to change the rules of this program at any time in its sole discretion.
5. By providing a report to Grafana Labs pursuant to this policy, you grant Grafana Labs an irrevocable, perpetual, royalty free, transferable, worldwide license to use and exploit the report.
6. Any report can be made public at the discretion of Grafana Labs.
7. Eligibility of Participants to participate in the Program shall be determined at the sole discretion of Grafana Labs. Individuals located in any country subject to a U.S. embargo or listed on any sanctioned persons list shall not be permitted to participate.
8. Safe harbor: Activities conducted in a manner consistent with this Policy will be considered authorized conduct and we will not initiate legal action against you for breach of any applicable license provisions. Note that you are still responsible for compliance with any local laws, and that this safe harbor does not extend to breach of any laws applicable to you.
9. Current or former (in the last 12 months) Grafana Labs employees and contractors are not permitted to participate in this program.
10. We target an initial response to requests within 1 business day and triage within 2 business days. Payouts should happen as soon as the vulnerability is confirmed (i.e. at triage time). Payouts are based on CVSS score and bonus points and are calculated by Grafana Labs in its sole discretion.
11. Grafana Labs reserves the right to make a determination of whether a violation of this policy is accidental or in good faith. When in doubt, please contact us at legal@grafana.com.
12. Governing Law; Limitation of Liability: The law that will apply in any dispute or lawsuit arising out of or in connection with this Program, and the courts that have jurisdiction over any such dispute or lawsuit will be New York, USA. In no event shall Grafana Labs be liable for any damages relating to the Program greater than USD$1,000.

This program follows Intigriti's contextual CVSS standard

Where can we get credentials for the app?

The default admin credentials for Grafana is admin:admin
Make sure to create additional users in Grafana with different permissions, such as Editor and Viewer.

How can I contact you?

Feel free to join our public community Slack Channel.