Terms of Bounty Program

QueryPie Inc., Ltd. (hereinafter referred to as the "Company") commences the implementation of the QueryPie Bug Bounty Program (hereinafter referred to as the "Program"), which provides rewards for reporting bug bounty vulnerabilities to the Company. Individuals who wish to participate in the Program and receive compensation must adhere to the following terms and conditions and are deemed to have agreed to the following terms and conditions while reporting a bug bounty.

Article 1 (Purpose)

The purpose of this program is to provide better safety and security to users of the Company services (hereinafter referred to as "users") through early detection, fixing, and improvement of vulnerabilities and bugs in Company services.

Article 2 (Eligibility for Participation, Method of Participation, etc.)

1. To participate in the Program, participants (“Participants”) must meet the following qualifications:

• Must be able to communicate in Korean or English.
• Must be a person who does not reside in a country subject to economic sanctions in the Republic of Korea, the United States, or other countries or regions subject to economic sanctions at the time of award payment.

2. In order for Participants to participate in this program, they must report on the website designated by the Company.
3. All necessary expenses required to participate in this program are to be borne by the participant.
4. Any necessary communication regarding the operation of this program is to be done via e-mail.

Article 3 (Scope)

The following QueryPie services are covered in the program:

• QueryPie Products

Note that the program is limited to the aforementioned services, and any reports that do not cover these services would be ineligible for a reward.

(※ The Querypie homepage (querypie.com) is not eligible for bug bounties.)

Article 4 (Period)

1. This program is always open. However, if necessary, the Company may terminate this program without prior notice.
2. Once a bug bounty report is submitted in compliance with the method guided, the QueryPie Bug Bounty team goes through its internal screening process and it may require 4 weeks for its review. If an additional time is required for finalizing its result, then the team may contact and announce its delay individually.
3. Pursuant to Paragraph 1, if there are reported vulnerabilities received before termination of this program, the Company will not discard but review them in accordance with the existing internal review process in Paragraph 2 and respond to the applicants with results.

Article 5 (Method of reporting)

Bug Bounty reports must be made via the Bug Bounty reporting website. Participants reporting risks via methods other than the Bug Bounty reporting website are excluded from reward payment.

When reporting a vulnerability, the participants are deemed to have agreed to Bug Bounty Program Terms and Conditions.

Article 6 (Submission Review and Rewards)

The Company, at its discretion, shall determine an award based on the severity of the risk reported.

1. The following vulnerabilities are not eligible for rewards:

• Enumerate accounts/emails using brute force attack
• Publicly-known Vulnerabilities
• Physical attacks
• HTTP Host Header XSS
• Denial-of-Service(DoS) Attack
• Missing Security HTTP Headers
• Page tampering using error pages
• All applications not part of the QueryPie services
• Internal scanning or destructive exploits
• Sensitive data Leakage
• In case of violation of the terms and conditions of this program
• If the vulnerability is not reproduced
• A Zero Day Vulnerability that has not been corrected
• Clickjacking/UI Redressing
• Missing cookie flags
• "Self" XSS
• Exposing the server's application information
• Client-side autocomplete or saved passwords/credentials
• Security, CSP header-related vulnerabilities
• Social Engineering attacks
• Other vulnerabilities deemed to be free from any security threats
• If the vulnerability is replicated and the Company is already aware of it
• Vulnerabilities occurring on browsers or platforms that are no longer supported.
• Vulnerabilities based on excessive user intervention or unrealistic assumptions.
• Bulk posting of content, comments, or messages repeatedly.
• If the same vulnerability is found across multiple points, only one report will be acknowledged.

2. In case the Company receives duplicate reports of the vulnerability, the reports will be considered as one.
3. If multiple Participants report the same vulnerability, the reward will be awarded only for the first report received by the Company.
4. If the Company determines that the reported vulnerability is subject to a reward, information received in accordance with the reward method is requested by the company through the e-mail address of the Participant written at the time of reporting, and the participant is obliged to reply with the accurate information. If the participant does not provide the requested information within 30 days of the company's request, he/she will be deemed to have waived his/her right to receive the award.
5. In the event that the participant does not receive all or part of the reward (may result from a discrepancy in the information provided) despite the appropriate reward delivery procedure conducted by the Company based on the given information by the participant, pursuant to Article 4, the Company’s obligation to pay the reward ceases to exist.
6. If the participant violates these terms and conditions, the Company holds the right to refuse the reward payment or may demand the return of the reward paid to the participant.

Article 7 (Prohibited Matters)

1. Participants must not:

• Perform any act that infringes on others' rights or violates other laws and regulations.
• Scan services with an automated program.
• Denial of Service (DoS) attack that overloads the service.
• Physical attacks on company assets or data centers.
• Perform any act of viewing, deleting, modifying, or disclosing user data by exploiting the discovered vulnerability.
• Perform any act of viewing, deleting, modifying, or disclosing the source code, etc., by using the discovered vulnerability.
• Perform any other act contrary to the purpose and purpose of this program.

2. The company may disqualify Participants from participating in this program for violating the terms mentioned in the aforementioned section.

Article 8 (Rights)

1. In the event that a participant invents, devises, or creates a design or authors a written work (hereinafter referred to as "invention") in reviewing the vulnerability verification and correction plan, all rights, including copyrights for inventions, etc., are transferred to the Company through the reporting website, and the Company is free to exercise and dispose of its rights.
2. The participant understands and acknowledges that pursuant to Article 1, the Company may develop materials similar to or identical to the submissions and waives any claims that may arise due to similarity to the submissions of the Participant.

Article 9 (Handling of Confidential Information)

Participants must treat vulnerabilities and the information learned through vulnerabilities (such as details on attack methods) as confidential information. The Participants shall not disclose, leak, or publish the information to any third-party entity without the Company's clear written consent. If a participant wishes to disclose the information, the Company will perform a review of the content, and it will be up to the discretion of the Company whether to disclose the information or not.

Article 10 (Handling of Personal Information)

1. The Company strives to protect personal information as prescribed by relevant laws and regulations such as the Personal Information Protection Act.
2. The Company collects personal information from participants in order to participate in the Program, which is deemed to be consented to by the participant when provided.

• E-Mail
• Name
• Company

3. The Company may use the personal information [email, name, affiliation] provided by Participants for this program to effectively conduct the program and to facilitate other necessary administrative processes.
4. The Company retains the personal information received from the participant for 3 years from the date of the participant's final report or for the retention period in accordance with relevant laws and regulations.

Article 11 (Indemnification)

1. Participants may participate in this program at their own risk, and the Company shall not responsible for any damages suffered by the participant as a result of their participation in this program, except for reasons attributable to the Participants.
2. The Company shall not be involved in any disputes between Participants or between Participants and third parties related to this program. The Participants are solely responsible for resolving the disputes and the expenses incurred.

Article 12 (Change of Terms and Conditions)

1. The Company may revise or amend the contents of the mentioned terms and conditions to the extent that it does not violate the relevant laws and regulations.
2. If the Company revises these terms and conditions, it will notify the users in advance by specifying the date of application.
3. Even after the Company has notified the revised terms in accordance with the aforementioned section, if the participant does not explicitly express his/her refusal within the set period, the participant shall be deemed to have agreed to the revised terms and conditions.
4. the revised terms and conditions are announced, and the bug bounty report is received after the effective date, the participant shall be deemed to have agreed to the revised terms and conditions.
5. If the participant does not agree to the application of the amended terms, he/she will not be qualified for the program.

Article 13 (Governing Law and Jurisdiction)

1. Lawsuits filed between the Company and Participants shall be governed by the laws of the Republic of Korea.
2. The court of competent jurisdiction for litigation regarding disputes between the Company and Participants is determined in accordance with the Civil Procedure Act.
3. In the case of a participant who has an address or residence abroad, litigation regarding a dispute between the Company and the participant shall be governed by the Seoul Central District Court, Republic of Korea, notwithstanding the aforementioned section.

Article 14 (Program Inquiries)

All inquiries regarding this program are received at bounty@querypie.com. Inquiries by any other means are not accepted.

Terms and Conditions Revision Date: 2023-09-22