Vulnerability Disclosure Program
Building a Stronger and Safer Digital Landscape Together
Example Vulnerability Disclosure Policy
We take the security of our software products, website, and network very seriously, and we appreciate your help in improving it. If you have discovered a vulnerability in our system, please let us know so that we can address it promptly.
Example welcomes feedback from security researchers and the general public to help improve our security. If you believe you have discovered a vulnerability, privacy issue, exposed data, or other security issues in any of our assets, we want to hear from you. This policy outlines steps for reporting vulnerabilities to us, what we expect, what you can expect from us.
Instructions for Reporting Vulnerabilities
- Please do not use this form to report issues that are not security-related.
- Please include as much detail as possible, including a description of the vulnerability, steps to reproduce it, and any relevant screenshots or code snippets.
- Please do not use the vulnerability to access or modify data without authorization.
- We ask that you do not publicly disclose the vulnerability until we have had a chance to address it.
Systems in Scope
This policy applies to any digital assets owned, operated, or maintained by Example.
Out of Scope
- Assets or other equipment not owned by parties participating in this policy.
Vulnerabilities discovered or suspected in out-of-scope systems should be reported to the appropriate vendor or applicable authority.
When working with us, according to this policy, you can expect us to:
- Respond to your report promptly, and work with you to understand and validate your report;
- Strive to keep you informed about the progress of a vulnerability as it is processed;
- Work to remediate discovered vulnerabilities in a timely manner, within our operational constraints; and
- Extend Safe Harbor for your vulnerability research that is related to this policy.
In participating in our vulnerability disclosure program in good faith, we ask that you:
- Play by the rules, including following this policy and any other relevant agreements. If there is any inconsistency between this policy and any other applicable terms, the terms of this policy will prevail;
- Report any vulnerability you’ve discovered promptly;
- Avoid violating the privacy of others, disrupting our systems, destroying data, and/or harming user experience;
- Use only the Official Channels to discuss vulnerability information with us;
- Provide us a reasonable amount of time (at least 90 days from the initial report) to resolve the issue before you disclose it publicly;
- Perform testing only on in-scope systems, and respect systems and activities which are out-of-scope;
- If a vulnerability provides unintended access to data: Limit the amount of data you access to the minimum required for effectively demonstrating a Proof of Concept; and cease testing and submit a report immediately if you encounter any user data during testing, such as Personally Identifiable Information (PII), Personal Healthcare Information (PHI), credit card data, or proprietary information;
- You should only interact with test accounts you own or with explicit permission from the account holder; and
- Do not engage in extortion.
Please report security issues via firstname.lastname@example.org, providing all relevant information. The more details you provide, the easier it will be for us to triage and fix the issue.
When conducting vulnerability research, according to this policy, we consider this research conducted under this policy to be:
- Authorized concerning any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy;
- Authorized concerning any relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls;
- Exempt from restrictions in our Terms of Service (TOS) and/or Acceptable Usage Policy (AUP) that would interfere with conducting security research, and we waive those restrictions on a limited basis; and
- Lawful, helpful to the overall security of the Internet, and conducted in good faith.
You are expected, as always, to comply with all applicable laws. If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our Official Channels before going any further.
Note that the Safe Harbor applies only to legal claims under the control of the organization participating in this policy, and that the policy does not bind independent third parties.
Our scope is dedicated to finding and mitigating potential vulnerabilities in the following software products, websites, and networks to ensure the secure handling of sensitive data for our customers.
|Scope Component||In Scope||Out of Scope|
|Website||www.example.com||Subdomains not listed under in-scope|
|API||API endpoint: api.example.com||Other API endpoints not listed under in-scope|
|Mobile Application New||iOS and Android versions of the app||Third-party integrations in the mobile app|
Note: This scope is subject to change at any time, and any changes will be communicated through updates to this page.
Our rewards program is designed to recognize and compensate security researchers for their efforts in helping us secure our systems and protect our users.
Rewards are determined based on the severity of the vulnerability and the quality of the report submitted. We will make a final determination on the reward amount and will take into consideration the impact and risk to our users.
Vulnerabilities with low severity risk that have a minimal impact on the confidentiality, integrity, and availability of the targeted system or data.
Vulnerabilities with medium severity risk that have a moderate impact on the confidentiality, integrity, and availability of the targeted system or data.
Vulnerabilities with high severity risk that have a critical impact on the confidentiality, integrity, and availability of the targeted system or data.
Vulnerabilities with high critical risk such as Remote code execution, unauthorized data access or modification
Rewards will be paid out via PayPal or a similar secure payment method.
We are grateful to the following researchers for their efforts in ensuring the security of our company's data and making it a safer place for everyone. Your contribution is greatly appreciated.