Terms and Conditions

  1. Ace Security Bounty awards are granted solely at our exclusive discretion. Any awards not accepted within one year, or waived, shall become ineligible for issuance. At our sole discretion, we may donate the value of such waived or other ineligible awards consistent with our charitable giving programs and policies.
  2. Ace reserves the right to immediately remove you from the Ace Security Bounty program if you violate any of these terms and conditions as determined by Ace, or if you violate any terms associated with the use of your Ace ID. This includes sending any harassing, threatening, or unlawful messages to Ace. Any such messages may be reported to relevant law enforcement entities.
  3. The Ace Security Bounty program extends to security research covering all Ace products and public-facing services, except research involving any of the following:
    1. Any non-public-facing Ace system
    2. Phishing, social engineering, or similar techniques
  4. The Ace Security Bounty program does not extend to third-party services.
  5. You must not disrupt, compromise, inappropriately access, store, or damage:
    1. Data or property (including a device) that you do not own, unless the data or property owner has given you express, written consent to disrupt, compromise, inappropriately access, store, or damage; or
    2. Ace services in a manner that can adversely affect other users. Adverse effects solely impacting you are allowed.
  6. For a reported security vulnerability affecting any Ace platform to be eligible for an Ace Security Bounty award, you must not disclose it to anyone other than Ace until after Ace has released a software update and published a security advisory for the reported security vulnerability.
  7. A participant in the Ace Security Bounty program will not be deemed to be in breach of applicable Ace license provisions which provide that a user of Ace software may not copy, decompile, reverse engineer, disassemble, attempt to derive the source code of, decrypt, modify, or create derivative works of such Ace software, for in-scope actions performed by that participant where all of the following are met:
    1. The actions were performed strictly during participation in the Ace Security Bounty program;
    2. The actions were performed during good-faith security research, which was — or was intended to be — responsibly reported to Ace; and
    3. Neither the actions nor the participant have otherwise violated or exceeded the scope of these terms and conditions.
  8. You must comply with all applicable laws (including directives, regulations, and ordinances), including those of the country or region in which you reside or in which you download or use Ace software or services.
  9. Ace Security Bounty awards may not be paid to you if you are in any U.S. embargoed countries or on the U.S. Treasury Department's list of Specially Designated Nationals, the U.S. Department of Commerce Denied Person's List or Entity List, or any other restricted party lists.
  10. You are responsible for the payment of all applicable taxes.