Sprout Social Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://sproutsocial.com/responsible-disclosure-policy/
name: Sprout Social vulnerability disclosure
description: >-
  Sprout Social publishes a named Responsible Disclosure Policy and runs a Vulnerability
  Disclosure Program with Bugcrowd. There is no /.well-known/security.txt on any Sprout
  host, so the policy is discoverable only through the site footer ("Disclosure Policy")
  and the security page — a machine looking for RFC 9116 finds nothing.

policy:
- https://sproutsocial.com/responsible-disclosure-policy/
program:
  type: vulnerability-disclosure-program
  platform: Bugcrowd
  url: https://bugcrowd.com/sproutsocial
  bounty: false
  note: >-
    Described as a VDP, not a paid bug bounty. Scope is defined on the Bugcrowd VDP page
    and testing must comply with Bugcrowd's Standard Disclosure Terms and with Sprout's
    Terms of Service.
contact:
- https://bugcrowd.com/sproutsocial
security_txt:
  present: false
  probed:
  - url: https://sproutsocial.com/.well-known/security.txt
    status: 404
  - url: https://sproutsocial.com/security.txt
    status: 404
  - url: https://api.sproutsocial.com/.well-known/security.txt
    status: 404

commitments:
- Maintain confidentiality with the reporter.
- Acknowledge receipt of a report in a timely manner.
- Assess validity of the submission and evaluate for severity and impact.
- Notify the reporter when the vulnerability is fixed.
- Publicly acknowledge the responsible disclosure, if the reporter wishes.

restrictions:
- Testing is permitted only against an account for which you are the Account Owner, or
  as an agent authorized by the Account Owner.
- No accessing or attempting to access data that does not belong to you.
- No DoS/DDoS, stress testing, or load testing of applications, systems or networks.
- No unsolicited or unauthorized email, spam or other unsolicited messages.
- No social engineering (phishing, vishing, smishing, link manipulation).
- No testing of third-party websites, applications or services that integrate with
  Sprout Social.
- No posting, transmitting, uploading, linking to or storing malware or viruses.
- No physical security testing.

security_page: https://sproutsocial.com/security/

evidence:
- source: https://sproutsocial.com/responsible-disclosure-policy/
  http_status: 200
  kind: disclosure-policy
  keywords:
  - responsible disclosure
  - vulnerability disclosure program
  - bugcrowd
- source: https://bugcrowd.com/sproutsocial
  http_status: 200
  kind: vdp-program-page
- source: https://sproutsocial.com/security/
  http_status: 200
  kind: security-program-page

gaps:
- No RFC 9116 security.txt is served from any Sprout host, so the disclosure route is
  not machine-discoverable.
- No dedicated security contact address is published on the policy page; reports are
  routed exclusively through Bugcrowd.