Business Bugsec Document

BUSINESS BUGSEC AGREEMENT

Client Name:   Client Address:

Contractor Name:   Contractor Address:

RECITALS

WHEREAS, Client operates business systems, applications, networks, and services (collectively, "Client Systems") that require periodic security assessment and vulnerability identification; and

WHEREAS, Contractor represents that Contractor possesses specialized expertise in security research, vulnerability discovery, and secure disclosure practices and is willing to perform such services under the terms of this Agreement; and

WHEREAS, the parties desire to define the scope, compensation, confidentiality obligations, and the procedures for responsible disclosure and remediation of identified vulnerabilities.

AGREEMENT

Effective Date: .

SCOPE OF WORK

Contractor shall perform security testing, vulnerability research, and preparation of written reports describing any verified vulnerabilities discovered in Client Systems. Testing shall be limited to systems and assets expressly authorized in writing by Client. Testing that is not expressly authorized is prohibited.

PAYMENT TERMS

Total Fee: $ payable in accordance with the schedule below.

Late Payment: Any undisputed amount not paid within days after the due date shall incur a late fee of % per month on the overdue balance, or the maximum permitted by law, whichever is less.

TERM AND TERMINATION

Term Commencement Date: . Termination Date: .

Either party may terminate this Agreement for convenience upon providing written notice to the other party at least days prior to termination. Either party may terminate immediately for material breach that remains uncured for days following written notice of such breach.

CONFIDENTIALITY

Definition: "Confidential Information" means non-public information disclosed by one party (Discloser) to the other (Recipient) that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure, including vulnerability reports, exploit details, remediation plans, and system architecture.

Recipient Obligations: Recipient shall: (a) use Confidential Information solely for performance under this Agreement; (b) restrict disclosure to employees, contractors, or advisors with a need to know and who are bound by confidentiality obligations at least as protective as those herein; and (c) implement reasonable administrative, physical, and technical safeguards to protect Confidential Information from unauthorized access or disclosure.

Exceptions: Confidential Information does not include information that: (i) is or becomes generally available to the public other than through a breach of this Agreement by Recipient; (ii) was rightfully known to Recipient prior to disclosure; (iii) is lawfully received from a third party without restriction; or (iv) is independently developed by Recipient without use of Discloser's Confidential Information.

Duration: Confidentiality obligations survive termination of this Agreement for a period of three (3) years, except that obligations with respect to Confidential Information constituting a secret under applicable law shall survive as long as such information remains a secret.

VULNERABILITY DISCLOSURE AND REMEDIATION

Reporting Procedure: Contractor shall promptly report discovered vulnerabilities to Client using the secure reporting channel designated by Client and shall provide a written report describing the vulnerability, steps to reproduce, potential impact, and suggested remediation. Client shall acknowledge receipt within business days.

Bounty and Credit: Payment of any bounty does not limit Client's rights to require remediation. Unless otherwise agreed in writing, ownership of data, remediation plans, and reports prepared by Contractor is assigned to Client upon payment of the applicable fee. Contractor may request public credit for responsibly disclosed findings, subject to Client's prior written approval, not to be unreasonably withheld.

REPRESENTATIONS, INDEMNITY, AND LIMITATION OF LIABILITY

Mutual Representations: Each party represents that it has full power and authority to enter into this Agreement and perform its obligations.

Indemnity: Contractor shall indemnify, defend, and hold harmless Client and its officers, directors, employees, and agents from and against claims, losses, liabilities, damages, and expenses arising out of Contractor's grossly negligent or willful misconduct in performing the services or any unauthorized testing outside the scope of authorization.

Limitation of Liability: Except for liability arising from gross negligence, willful misconduct, breach of confidentiality, or Contractor's indemnification obligations, neither party shall be liable for consequential, incidental, special, punitive, or exemplary damages; each party's aggregate liability for direct damages under this Agreement shall not exceed the total fees paid to Contractor under this Agreement in the twelve (12) months preceding the claim.

GOVERNING LAW; DISPUTE RESOLUTION

Governing Law: This Agreement shall be governed by and construed in accordance with the laws of the State of , without regard to its conflict of laws principles.

Dispute Resolution: The parties shall first attempt in good faith to resolve any dispute arising out of or relating to this Agreement through negotiation. If unresolved within thirty (30) days, the parties agree to submit the dispute to binding arbitration in accordance with the applicable arbitration rules selected by mutual agreement.

ENTIRE AGREEMENT; AMENDMENT

Entire Agreement: This Agreement, together with any exhibits or written amendments signed by both parties, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals, and communications, whether written or oral.

Amendment: Any modification or amendment to this Agreement must be in writing and signed by authorized representatives of both parties.

MISCELLANEOUS PROVISIONS

Independent Contractor: Contractor is an independent contractor and nothing in this Agreement creates an employment, partnership, joint venture, or agency relationship.

Notices: All notices required or permitted under this Agreement shall be in writing and delivered to the addresses set forth above, or to such other address as a party may designate by notice.

Severability: If any provision of this Agreement is found to be unenforceable, the remaining provisions shall remain in full force and effect to the maximum extent permitted by law.

Sign Now