Vulnerability Disclosure Policy

Kyriba Corp. ("Kyriba") welcomes feedback from security researchers and the public to help strengthen our security. If you believe you have identified a vulnerability, privacy issue, exposed data, or another security concern in any of our assets, please let us know. This policy explains how to report vulnerabilities, what we ask of you, and what you can expect from us. Kyriba's Vulnerability Disclosure Policy does not provide monetary bounties for valid vulnerability reports.

Submission of a vulnerability report under this policy does not create any legal relationship or contractual obligation beyond what is expressly stated herein.

Systems in Scope

This policy applies to digital assets owned and directly controlled by Kyriba, including the systems expressly listed below. Systems operated by Kyriba on behalf of third parties, customer-managed environments, or infrastructure not directly owned by Kyriba are excluded from this policy.

In-scope systems include:

• Kyriba sandbox environments: *-sandbox.treasury-factory.com
• Any additional systems expressly listed at https://www.kyriba.com/legal-pages/vulnerability-disclosure-policy/ (updated periodically).

Out-of-Scope Systems

The following systems and activities are not authorized for testing under this policy:

• Assets or other equipment not owned by parties participating in this policy.
• All production environments, explicitly excluding the sandbox environments listed in the In-Scope section above.
• Testing of authenticated application functionality using credentials not issued directly to the researcher by Kyriba for testing purposes
• Third-party services and software integrated into Kyriba's platform (report such findings to the relevant vendor).
• Automated or scripted scanning tools directed at any Kyriba environment without prior written approval from Kyriba's security team.

Vulnerabilities discovered or suspected in out-of-scope systems should be reported to the appropriate vendor or applicable authority.

Out-of-Scope Vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out-of-scope:

• Clickjacking on pages with no sensitive actions
• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
• Attacks requiring MITM or physical access to a user's device
• Previously known vulnerable libraries without a working Proof of Concept
• Comma Separated Values (CSV) injection without demonstrating a vulnerability
• Missing best practices in SSL/TLS configuration
• Any activity that could lead to the disruption of our service (DoS)
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
• Rate limiting or bruteforce issues on non-authentication endpoints
• Missing best practices in Content Security Policy
• Missing HttpOnly or Secure flags on cookies
• Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
• Vulnerabilities only affecting users of outdated or unpatched browsers [less than 2 stable versions behind the latest released stable version]
• Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors)
• Tabnabbing
• Open redirect — unless an additional security impact can be demonstrated
• Issues that require unlikely user interaction

What to report

• OWASP Top 10 vulnerability categories (as defined in current version available at owasp.org/Top10)
• Other vulnerabilities with demonstrated impact (including, for example: authentication bypass, privilege escalation, remote code execution, significant data exposure, or business logic flaws with material financial impact)

What not to report

• Theoretical vulnerabilities.
• Informational disclosure of non-sensitive data.
• Low-impact session management issues.
• Self-XSS using a user-defined payload.

Prohibited Activities

The following activities are expressly prohibited under this policy regardless of system:

• DNS zone walking
• DNS pharming
• Denial-of-service (DoS) or distributed denial-of-service (DDoS) attacks.
• Protocol flooding
• Request flooding, including login or API request flooding.
• Phishing

• Social engineering of Kyriba employees, contractors, or service desk personnel (including vishing, spear-phishing, or impersonation)
• Physical testing of any kind, including attempts to gain unauthorized physical access to Kyriba facilities, data centers, or hardware
• Brute force attacks against authentication endpoints
• Testing using automated or scripted scanning tools against any Kyriba environment not expressly authorized in writing
• Accessing, exfiltrating, retaining, or sharing data that does not belong to you or that you are not expressly authorized to access
• Violating any applicable law or breaching any third-party agreement in connection with vulnerability research

Subdomain & Resource Takeovers

Permitted (In Scope)

Researchers may demonstrate that a subdomain, S3 bucket, or comparable cloud resource is susceptible to takeover, subject to the following conditions:

• Minimal demonstration. The researcher shall claim the orphaned resource solely to evidence control and shall take no further action thereafter.
• Inert marker only. The researcher shall host a single, benign, clearly-labeled file (e.g., vdp-poc-<handle>-<date>.txt) and no other content, scripts, or active pages.
• No data interaction. The researcher shall not collect, intercept, log, store, redirect, or inspect any traffic, data, credentials, cookies, or communications routed to the resource.
• Limited retention. The researcher shall retain control only as long as necessary to evidence and report the finding, and shall hold the resource safely until Kyriba confirms remediation, or until Kyriba explicitly requests its release or transfer.
• Immediate notice. The researcher shall report the finding without delay, specifying the resource, method, and time of claim.

Prohibited (Out-of-Scope)

• The following actions are unauthorized and fall outside this policy's protections:
• Hosting active, deceptive, or malicious content, including phishing, malware, or impersonation of Kyriba or any third party.
• Capturing, intercepting, redirecting, or retaining any traffic, data, credentials, or communications.
• Retaining control beyond the demonstration period or declining to release the resource upon request.
• Leveraging the takeover to access, pivot to, or exploit any other system.
• Demanding payment or other consideration in exchange for release or non-disclosure.
• Disclosing, advertising, or displaying the takeover prior to remediation and agreed disclosure timing.
• Defacing, degrading, or disrupting the resource or any dependent service.

Our Commitments

When you work with us under this policy, you can expect us to:

• Acknowledge receipt of your vulnerability report within three (3) business days of submission, and work with you to understand and validate your report;
• Strive to keep you informed about the progress of a vulnerability as it is processed;
• Provide you with a status update no less frequently than every thirty (30) days while your report is under active review;
• Work to remediate discovered vulnerabilities in a timely manner, within our operational constraints; and communicate our severity assessment and expected remediation timeline within ten (10) business days of report validation; and
• Extend Safe Harbor for your vulnerability research that is related to this policy.

Our Expectations

In participating in our vulnerability disclosure program in good faith, we ask that you:

• Play by the rules, including following this policy and any other relevant agreements. If there is any inconsistency between this policy and any other applicable terms, the terms of any existing contractual agreement between you and Kyriba, Inc. (or its subsidiaries) shall take precedence over this policy. In the absence of such a contractual agreement, the terms of this policy will prevail. Report any vulnerability you've discovered promptly;
• Avoid violating the privacy of others, disrupting our systems, destroying data, and/or harming user experience;
• Use only the Official Channels to discuss vulnerability information with us;
• Provide us a reasonable amount of time (at least 90 days from the initial report) to resolve the issue before you disclose it publicly;
• Perform testing only on in-scope systems, and respect systems and activities which are out-of-scope;
• If a vulnerability provides unintended access to data: Limit the amount of data you access to the minimum required for effectively demonstrating a Proof of Concept; and cease testing and submit a report immediately if you encounter any user data during testing, such as Personally Identifiable Information (PII), bank account or financial transaction data, or proprietary information; and promptly and permanently delete any such data from all systems and storage media in your possession, and certify such deletion to Kyriba upon request;
• Do not engage in extortion.

Vulnerability Severity and Prioritization

Kyriba retains sole authority to determine vulnerability severity, prioritization, and remediation timelines. We base our internal risk assessment exclusively on:

• System function: The role and criticality of the affected system in our business operations.
• Data storage: The type, volume, and sensitivity of the data stored or processed.
• Network location: The system's position, segmentation, and access controls within our infrastructure.

Kyriba's severity determinations are independent of CVE scores and CWE severity ratings. Public scoring systems do not account for our specific architecture, compensating controls, network segmentation, or operational context. We evaluate each vulnerability based on the actual risk to Kyriba's environment and our customers' data.

We will communicate our severity assessment within ten (10) business days of validating your report. Remediation timelines will be provided where operationally feasible and will be updated if circumstances change.

Official Channels

Please report security issues to [email protected] and include all relevant information. The more detail you provide, the easier it will be for us to triage and address the issue.

For reports involving critical or high-severity vulnerabilities, or reports that include sensitive data, we strongly encourage the use of encrypted communications. Please contact us at [email protected] to request a secure link for an alternative secure submission method.

Safe Harbor

• When you conduct vulnerability research under this policy, we consider that research to be:
• Authorized concerning applicable anti-hacking laws, and we will not initiate or support legal action against you for unintentional, good-faith violations of this policy committed during security research.
• Authorized under relevant anti-circumvention laws, and we will not bring a claim against you for circumventing technology controls.
• Exempt from restrictions in our Terms of Service (TOS) or Acceptable Use Policy (AUP) that would otherwise interfere with security research, to the extent necessary to conduct security research in compliance with this policy, and we waive those restrictions on a limited basis; and
• Lawful, helpful to the overall security of the internet, and conducted in good faith.

You are expected, as always, to comply with all applicable laws. If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before going any further.

Note that the Safe Harbor applies only to legal claims under the control of the organization participating in this policy, and that the policy does not bind independent third parties.

The Safe Harbor provisions of this policy do not apply to, and no protections are extended to, any individual or entity that is (i) located in, organized under the laws of, or ordinarily resident in a country or territory subject to comprehensive U.S. sanctions, or (ii) identified on any U.S. government restricted-party list, including the OFAC Specially Designated Nationals and Blocked Persons (SDN) List.

Policy Modifications

Kyriba reserves the right to modify or discontinue this policy at any time. For material changes to the scope, safe harbor terms, or disclosure window, Kyriba will provide at least thirty (30) days' notice by updating the Effective Date at the top of this policy and publishing the updated policy at https://www.kyriba.com/legal-pages/vulnerability-disclosure-policy/.