PHRASE BUG BOUNTY PROGRAM SCOPE

This page identifies the assets authorized for security testing under the Phrase Bug Bounty Program. It forms part of the Program Terms and must be read together with the Rules of Engagement and Safe Harbor provisions

1. In Scope

Researchers may test the following assets and functionality:

• https://us.phrase.com
• Production applications, services, and API endpoints directly associated with and necessary to operate https://us.phrase.com, except where explicitly listed as out of scope
• Phrase TMS, Phrase Strings, and Phrase Studio functionality accessible through the US environment
• Additional US-only hostnames or API endpoints expressly listed in the Approved Assets section below

Testing must be conducted in accordance with all Program Terms, including the Rules of Engagement and Safe Harbor requirements.

2. Approved Assets

Maintain this list as the authoritative register of explicitly approved hostnames and endpoints:

• us.phrase.com
• api.us.phrase.com
• Other approved US-only service hostnames, added here when authorized

3. Out of Scope

The following assets, environments, testing methods, and finding types are not eligible for testing or bounty consideration:

• https://eu.phrase.com, including all EU-hosted applications, services, APIs, and endpoints
• https://phrase.com, including marketing pages, blogs, documentation, careers pages, campaign pages, and other informational or static content
• Development, staging, test, preview, sandbox, demo, and internal environments, unless explicitly added to the approved-assets register
• Third-party services, integrations, platforms, and infrastructure not owned and operated by Phrase
• Denial-of-service, stress, load, volumetric, or otherwise disruptive automated testing
• Findings without a demonstrable security impact, including missing security headers, version disclosure, and best-practice-only recommendations