Education Bug Bounty Document

EDUCATION BUG BOUNTY PARTICIPATION AGREEMENT

Participant Information

Student Name:

Date of Birth:    Student ID:

Parent / Guardian (if Participant is Minor)

Parent/Guardian Name:

Program Enrollment & Scope

Enrollment Date:    Program Coordinator:

This Agreement governs authorized vulnerability research and reporting directed to the institution's educational technology systems and services expressly listed in the program scope. Excluded systems include systems marked as out-of-scope by the program coordinator or systems containing sensitive personal records, financial records, or medical records unless explicit written authorization is provided.

Eligibility, Authorization and Prohibited Actions

Participant Type: Student Staff / Faculty Contractor / Volunteer

Prohibited actions include exploitation that results in data exfiltration, disruption of operations, unauthorised access to student or staff records, social engineering of staff or students, physical tampering with hardware, or distribution of malware as part of testing. Participant must cease testing immediately if directed by the institution.

Responsible Disclosure Procedure

Participant agrees to follow the required disclosure process: provide a clear description of the vulnerability, steps to reproduce, potential impact, and any proof-of-concept code in a manner that avoids further risk. Participant must not publicly disclose a vulnerability until the institution has completed remediation or provided written consent for disclosure.

Rewards, Recognition, and Payment

Rewards may be offered at the institution's discretion. Eligibility for monetary or other rewards requires timely, complete, and responsible disclosure. Rewards are subject to verification, available budget, and any applicable tax or institutional reporting policies.

Confidentiality, Data Handling and Privacy

Participant will treat all information received during testing and in reports as confidential. Participant will not access, copy, or retain personal data, nor disclose vulnerabilities or remediation details to third parties without written authorization. Any evidence collected for reproduction may be shared with the institution but must be securely destroyed upon request.

Intellectual Property and License

Participant grants the institution a non-exclusive, royalty-free, worldwide license to use, reproduce, and modify reports and related materials submitted for the purpose of evaluation and remediation. Participant retains rights to original work except where rights are assigned in writing.

Liability, Indemnification and Discipline

Participant agrees to indemnify the institution for any losses arising from actions outside the authorized scope or contrary to this Agreement. The institution disclaims liability for incidental or consequential damages resulting from participation. Participants who violate this Agreement may be subject to disciplinary action under applicable institutional policies.

Acknowledgments and Certifications

By signing, Participant certifies that they understand the program scope and rules, will act in good faith to avoid harm, and will cooperate with the institution to remediate vulnerabilities. If the Participant is a minor, the Parent/Guardian certifies authorization for the minor to participate under these terms.

Agreement Certification

Please affirm the statements below by checking each box. Failure to affirm may render this form incomplete.

I understand and will abide by the program scope and exclusions.
I will follow the responsible disclosure procedure and not publicly disclose findings without authorization.
I agree to maintain confidentiality of sensitive information and cooperate with remediation.
I accept the liability and indemnification terms for actions outside authorized scope.

Sign Now