Grade C+ — Standard consumer terms (score 68/100)
BCG vulnerability disclosure terms grant a perpetual worldwide license to all submissions, disclaim all liability, allow unilateral changes without notice, and specify Massachusetts governing law. PGP key provided.
BCG responsible disclosure ToS: perpetual license, broad liability disclaimer, unilateral changes
you grant us a perpetual, worldwide, royalty-free, fully paid-up license to use and disclose any information you submit...or for any other legitimate business purpose.
Researchers give BCG permanent ownership-like rights to all submitted vulnerability information and code, with no IP rights retained by the researcher.
BCG...shall not be liable to you in connection with these Terms of Use for any direct, indirect, exemplary, incidental, special or consequential damages.
BCG disclaims all legal responsibility for any harm researchers might suffer while participating in the program.
These Terms of Use are governed by the laws of the Commonwealth of Massachusetts, without regard to conflict of laws principles.
All disputes are governed by Massachusetts law, which may be inconvenient for researchers residing elsewhere.
BCG reserves the right, in its sole discretion, to modify the terms of the Responsible Disclosure Guidelines or to terminate any or all of them at any time.
BCG can change or cancel these terms whenever they want without giving researchers any notice.
Please use our PGP key posted in the collapsible element below to send an encrypted message.
BCG publishes a PGP key so researchers can encrypt their vulnerability submissions for stronger confidentiality.
If you submit a vulnerability report to us...in compliance with all of the terms in these Terms of Use, we will not pursue civil action or initialize a complaint to law enforcement against you.
BCG grants legal safe harbor to compliant security researchers, shielding them from civil suit or criminal complaint.
Last reviewed 2026-09-17 under rubric v3.5.