We reserve the sole right to make the determination of whether a violation of this policy is accidental or in good faith, and proactive contact to us before engaging in any action is a significant factor in that decision. Please contact us before engaging in conduct that may be inconsistent with or unaddressed by this policy. You are expected, as always, to comply with all laws applicable to you, and not to disrupt or compromise any data beyond what our bug bounty programs permit. We cannot and do not authorize security research in the name of other entities, and cannot in any way offer to defend, indemnify, or otherwise protect you from any third party action based on your actions. Please understand that if your security research involves the networks, systems, information, applications, products, or services of a third party (which is not us), we cannot bind that third party, and they may pursue legal action or law enforcement notice. We waive any potential DMCA claim against you for circumventing the technological measures we have used to protect the applications in our bug bounty programs’ scope. We consider security research and vulnerability disclosure activities conducted consistent with this policy to be “authorized” conduct under the Computer Fraud and Abuse Act, the DMCA, and other applicable computer use laws such as WA Criminal Code 9A.90. To encourage research and responsible disclosure of security vulnerabilities, we will not pursue civil or criminal action, or send notice to law enforcement for accidental or good faith violations of Microsoft Bug Bounty Terms and Conditions ('the policy'). If your security research as part of the bug bounty program violates certain restrictions in our site policies, the safe harbor terms permit a limited exemption.We will only share identifying information (name, email address, phone number, etc.) with a third party if you give your written permission.

We may provide non-identifying substantive information from your report to an affected third party, but only after notifying you and receiving a commitment that the third party will not pursue legal action against you. Because both identifying and non-identifying information can put a researcher at risk, we limit what we share with third parties.If in doubt, ask us before engaging in any specific action you think might go outside the bounds of our policy. We cannot bind any third party, so do not assume this protection extends to any third party. We want you to responsibly disclose through our bug bounty programs, and don't want researchers put in fear of legal consequences because of their good faith attempts to comply with our bug bounty policy.

Safe harbor