Vulnerability Disclosure Program

Security is at the heart of everything we do at Alation. We identify and remediate most vulnerabilities through extensive internal and external third-party testing. Even with industry-leading products, SSDLC processes, and the best people, it is inevitable that something may go undiscovered. Alation welcomes feedback from responsible security researchers and the general public.

Responsible Disclosure

If you believe you have discovered a security vulnerability, a privacy issue, exposed data, or other issues, please email the details to security@alation.com to open a report. Include the following details with your email:

• Your name

• Description with sufficient detail required to identify and reproduce the vulnerability (e.g. step-by-step instructions)

Our Commitments

When you responsibly disclosure a vulnerability to Alation, we will:

• Acknowledge your report within five (5) business days

• Strive to maintain transparency about the progress of your report

• Work to remediate validated vulnerabilities in a timely manner

Policy

Alation’s Vulnerability Disclosure Program (the “Program”) allows for responsible and confidential disclosure of vulnerabilities to help enhance the security of the technology assets that Alation owns, operates, and maintains. Alation will engage with security researchers when vulnerabilities are reported to us in accordance with this Vulnerability Disclosure Policy (the “Policy”).

A “Vulnerability” is a security flaw or weakness in the technology asset that can be exploited to gain access and/or modify information, and change the behavior of, divert, and/or modify the application’s intended purpose.

Alation reserves the right to assess each Vulnerability to determine if it qualifies or has been reported previously. The “Reporter” of a vulnerability agrees to the following Parameters and Exclusions (“Term and Conditions”). Alation will not initiate legal actions against security researchers so long as they abide by this Policy.

Terms and Conditions

Parameters

If you participate in the Program, we ask that you:

• Email the vulnerability details promptly to security@alation.com to open a report

• Handle the confidentiality of details of any discovered vulnerabilities according to this Policy

• Do not report the same vulnerability multiple times

• Do not make any public statements or report vulnerabilities to other websites or people

• Do not access, destroy, or compromise Alation’s or its customers’ computer systems and data

• Avoid privacy violations

• Do not degrade Alation’s services during your research (e.g. Denial of Service)

• If a vulnerability provides unintended access to data, (1) Limit the amount of data you access to the minimum required for effectively demonstrating a proof of concept, (2) Cease testing and submit a report immediately

• Do not use automated scanners

• Do not violate any (a) federal or state laws or regulations or (b) the laws or regulations of any country where the Reporter is conducting security research

Exclusions

The following exclusions are considered out-of-scope from the Program:

• Vulnerabilities affecting users of outdated or unsupported browsers or platforms

• Open ports without an accompanying proof-of-concept demonstrating vulnerability

• Self-XSS that cannot be used to exploit other users

• Cross-site Request Forgery (CSRF) with minimal security implications (Logout CSRF, etc.)

• Clickjacking and the issues exploited only by clickjacking

• Host Header Injection or content injection issues

• Missing/Enabled HTTP Headers/Methods which do not lead directly to a security vulnerability

• IPbrute force attacks (e.g. DoS/DDoS)

• SSO related vulnerabilities

• Domains/subdomains not in active service

• CommaSeparatedValues (CSV) injection without demonstrating a vulnerability

• Physical or social engineering attempts

• Email/SMS flooding attacks

If you are unsure whether your conduct complies with the Program, please reach out to security@alation.com to connect with our Security Team.