GROUPON WEBSITE RESPONSIBLE DISCLOSURE

Groupon’s Commitment to Security

At Groupon we are committed to maintaining the security of our systems and data. We believe that good security is critical to maintaining the trust of our customers, merchants and employees. As such, we strive to continuously improve our security to ensure that we are prepared to meet the challenges posed by an ever-evolving threat landscape.

Bug Bounty Program

We value your input. When properly notified of a security issue we are committed to working with you to understand and remediate verified problems. If you believe you find an issue on our site, we encourage you to report it to us in a private and responsible way. In order to encourage this, we have established a reward program which will pay a bounty for verifiable security issues reported to us through the proper channel.

What Vulnerabilities Qualify for the Bounty?

Although not an exhaustive list, any issue that potentially affects the confidentiality, availability, or integrity of our customer's data will be considered for a bounty. Some examples of those types of issues include:

  • Cross-site scripting (XSS)
  • Cross-site request forgery (CSRF)
  • SQL/Code Injection
  • Issues identified with our authentication or session management mechanisms

Similarly, we also have a number of issues for which we will generally not pay out a bounty - and which include anything that reports an act that is abusive or in bad faith. These include:

  • Bugs identified via off the shelf vulnerability or security scanners including opensource / free / or commercial tools, i.e. burpsuite, Websecurify, Zed, Wikto.
  • Infrastructure attacks, including brute force or denial of service
  • Tools that generate significant amount of traffic volume or any activity deemed to be disruptive to other users
  • Attacks against other user accounts(target your own account only)
  • Bugs that we are already fixing or that someone else has previously reported
  • Underspecified reports where the information provided is insufficient to reproduce the vulnerability
  • Functionality bugs which do not compromise the security of our users’ accounts or personal information
  • Bugs that have been disclosed publicly or to third parties (brokers) by you or others
  • Vulnerabilities on sites that are not owned or operated by Groupon
  • Testing a suspected vulnerability in a way that violates any law or compromises data that is not your own
  • POC videos or other materials that prove the issue have been uploaded to third party website, even if marked as not publicly searchable

Reporting Suspected Vulnerabilities

If you believe that you have found a vulnerability, please report it to responsible-disclosure@groupon.com. A written description is required if you are sending a POC video. Our security team will interact with you directly from there. We encourage the use of encryption in your communications with us and ask that you encrypt your message to us whenever possible. Our public PGP key can be downloaded from here and is located at the bottom of this page.

Terms

Please note that whether to award bounties and the bounty awarded for identified issues will vary and remain at all times at Groupon’s discretion. If multiple vulnerabilities are reported or are closely related, we may choose to only award a single bounty. We may choose not to award bounties when we launch new products for a beta period, or otherwise are actively in a development or upkeep cycle. We may also require documentation for tax reporting purposes before we are able to pay certain bounties and we are unable to award bounties to individuals or in situations where to do so would violate a sanction list maintained by the U.S. Office of Foreign Assets Control (“OFAC”) or conflict with the letter or spirit of other applicable State, Federal or Territorial law, rule or regulation. Notwithstanding any of the above, Groupon reserves the right to cancel or modify this program at any time and without notice.

Last Updated: April 21, 2016

Our PGP key:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQENBFU6ZZABCACm27J5oCBSHzHVN0yQSDCrS5gJxsGTAq0rnpluomL/k3eOEDLn
3UC0Wt/+xQIome4THA216o+lNtlbmlqoQULjYN1JT4G/gIEAF0zC/WGB92QbO5UI
RFhoAL8eFEu6Mrvp3K7YjyIu7ah2WacR/Vl5OmdIBOyiqF1nQU1l7XpOSpytglyd
0ixWLS+IiJsdwQAdpa1tRle5uYgkSHlXyj2a6lI8e4bSHN6XpsWeLis6RYTNtJOQ
ZDGRA5j0NnWubKeFQeDTVTQfshDcfwuX4D3XlL58jDBsIuQOgdm0tWegfoi2I6I7
9c9xSrertWXaS3DNx/itclPyRF9+engGQPg1ABEBAAG0Tkdyb3Vwb24gU2VjdXJp
dHkgKFJlc3BvbnNpYmxlIERpc2Nsb3N1cmUpIDxyZXNwb25zaWJsZS1kaXNjbG9z
dXJlQGdyb3Vwb24uY29tPokBPgQTAQIAKAUCVTplkAIbAwUJBaOagAYLCQgHAwIG
FQgCCQoLBBYCAwECHgECF4AACgkQpNG/HBdu04UFjQgAlNDsIMjqBQWJ9MisP8mJ
i6CgYefvmrS5yUZNXd21/KDiDs5xPDlQ+hpnAkTuBKFS6J0/Dn8Ik+5R2k/wvEn0
Vg+vBgujF0WyYnjAa4dGzG0+Wvb9jmXj0GKmuHFZhUrxoxYNi+/rrFurMmtG1p5t
VT6lJaVwIPm71UyYB2M0iUzT8sNugjtgHac3/baF53K8uOpPXPMNNJ/9tra42UPP
pIZfHap4GdqianVcryfdlYLHTC07E8H4QZKt/pFaKqisMtAlICSJxO9NTDlpE9WD
0oByDXOZFl/UeEqRCC+D4YNijlrpfVB9vNoLPz85o9qN5MAJtWkbtrFtNR21Ur2c
T7kBDQRVOmWQAQgA03TNqORHRVmRzExbeSxkrNYfpETgqDy7gAW5XoE6MYL2Sr3V
bFnuk22JSCe1KRMRc7r9qJJHiVjhE9ZMNeAtd5VRf8vp1aTadMIodXH9dRG5XelZ
oQZnZ5hXSThHpFxX+Hsq9ZEMLfMuu5jkyzNFMVvDlfTOxjofxszETQFe8xfkkc9A
Ccj8h2LGtHBOyDoC6cAxQLGhkqQVh2+lfY62zmoOY4zUu3xh9CQNFeqOa/Aw63p/
Zg2CWpyjD7EMd6ur7heGcb1pTgzfyParcbq7J0cXyG4seHp0DprH7yLFrBZXPRaD
3bLzVbncd/+y0exMyC5PZpH0Z8XRbZBPiOZ5MwARAQABiQElBBgBAgAPBQJVOmWQ
AhsMBQkFo5qAAAoJEKTRvxwXbtOFljsH/j8JPxHsds+wLdVyNq2ogCBODlKKbAgP
JM/CHGgWJsG+tL+Q/ISTju+0Z4B+D+afMQt87MVTiKkcGZhMIpQU3UP8+3pebpUi
0SJjraj0oCmxcCUlzjkTUvGtEw7PwRE4kQybx65OcG8iOzGqn7dm1TIxT0dfriIi
f9vRkuZl2DaQqivXOLIiiSpnhbjxXfBHCCiCnopPLiQnq1zjkZKHPrAn4rUF6s6n
U7oKa9aT5MoV3lKlXfGeQpfaWJgdjuFIRTsgXNXQ4jguWvTZRQ6i7S3055NDqydn
Z9QJXP9j8gCnEW1tVSk7xPuCJnPg8ehsyjXyqXoskv1/VFVv/OBR3tY=
=IfnW
-----END PGP PUBLIC KEY BLOCK-----

PGP Fingerprint:
2B23 9686 089B 5D61 5D47  895F A4D1 BF1C 176E D385