Vulnerability Disclosure Policy
Effective Date: February 1, 2021
Version: 1.0

1.

Introduction

Staples is committed to ensuring the security of our customers and the information they sharewith us via our online platforms and services. We also recognize the valuable efforts thatsecurity researchers play in highlighting cybersecurity vulnerabilities and concerns. The purposeof this policy is to provide clear guidelines for conducting vulnerability discovery activities andto convey how to submit discovered vulnerabilities.

2.

ComplianceIf you comply with this policy during your security research, and you discover and reportsecurity vulnerabilities in accordance with this policy, we will not take legal action against you.
We reserve all legal rights in the event of any non-compliance with this policy.

3.

Requirements

This policy requires that you:
• Notify us as soon as possible after you discover a real or potential security issue;• Make every effort to avoid privacy violations, degradation of user experience, disruption
to systems and destruction or manipulation of data;• Only use exploits to the extent necessary to confirm a vulnerability’s presence — do not
use an exploit to collect, modify or delete data, establish persistent access or accessand/or test other systems, networks or applications; and• Do not disclose the details of any alleged vulnerability to third parties without express
written consent from Staples — unauthorized disclosure will deem the submission as
noncompliant with this policy.
Once you’ve established that a vulnerability exists or encounter any confidential or sensitive
data (including personal information, financial information, or proprietary information), youmust stop your test, notify us immediately and not disclose this data to anyone else.

4.

Test Methods

The following test methods are not authorized:• Denial of service (DoS or DDoS) tests or other tests that stress-test or have the potential
to impair access to or damage systems, networks, applications or data, even if
temporarily• Accessing, downloading or modifying data residing in an account that does not belong
to you•••••5.

Testing in a manner that would result in sending unsolicited or unauthorized junk mail,spam, e-mail notices, phone calls, text messages or other forms of unsolicited messages
to other parties — including Staples associates, customers or partners
Social engineering, including but not limited to misrepresenting Staples or its personnel
Trespassing or other tests with a physical security aspect
Posting, transmitting, uploading, linking to, sending or storing any malicious software
Testing third-party systems, networks, applications, and services, even if operated onbehalf of Staples

Scope

This policy applies to the following Staples family websites and services:• Staples.com• StaplesConnect.com• StaplesAdvantage.com• StaplesPromotionalProducts.com• Quill.com• HiTouchBusinessServices.com
Though we develop and maintain other Internet-accessible systems and services, research andtesting under this policy is restricted to the systems and services listed in this section. If there isa particular system or service not in scope that you think merits testing, please contact us todiscuss. We may change the scope of this policy over time.

6.

Reporting a Vulnerability

We accept vulnerability reports via email to vulnerabilityreport@staples.com. Reports may besubmitted anonymously.

What we would like to see from you
In order to help us triage and prioritize submissions, we recommend that your report:• Describes full details of the vulnerability and its location;• Provides step-by-step instructions for us to be able to validate and reproduce thefinding; and• Includes any proof of concept scripts or resulting artifacts, such as screen captures.

What you can expect from us
If you submit a valid security vulnerability in compliance with this policy, we will:• Acknowledge the receipt of the report within 5 business days;• Communicate with you to understand and validate the issue as necessary; and• Address the submitted vulnerability as appropriate, as deemed by Staples.

Note that Staples does not operate a bug bounty program and we make no offer ofcompensation in exchange for submitting potential issues.
Staples may modify the terms of this policy or terminate this policy at any time.

7.

QuestionsIf you are in doubt about the scope, acceptable test methods or any other provisions of thispolicy, you are encouraged to contact us first at vulnerabilityreport@staples.com. We also
invite you to contact us with suggestions for improving this policy.