Update Vulnerabiltiy disclosure program.yaml #110
Conversation
A security@company email address or submission form that receives only vulnerabilities A clear description with examples of what is defined as a security vulnerability. Companies with bug bounty programs should also include a mechanism to report vulnerabilities that non-technical consumers can use to report bugs.
…clarity Update Vulnerability disclosure program.yaml
| @@ -9,6 +9,13 @@ criterias: | |||
| - indicator: >+ | |||
| The company has a mechanism (ex: a bug bounty program) through which security researchers can | |||
| submit vulnerabilities they discover. | |||
|
|
|||
| A company with a bug bounty program has an alternative mechanism to report vulnerabilities that non-technical | |||
| consumers can use to report vulnerabilities. | |||
There was a problem hiding this comment.
Instead of asking conpanies for having a vulnerability report portal for non-technical consumers, is it ok to say that A company with a bug bounty program has an alternative mechanism to report bugs that non-technical consumers can use.
| A company with a bug bounty program has an alternative mechanism to report vulnerabilities that non-technical | ||
| consumers can use to report vulnerabilities. | ||
|
|
||
| The company provides a clear description with examples of what is defined as a security vulnerability. |
There was a problem hiding this comment.
We probably don't want companies to define security vulnerability. So, security researchers can report any finding or concern they have to companies. @billfitzg @mrerecich @stephtngu-CR
|
|
||
| The company provides a clear description with examples of what is defined as a security vulnerability. | ||
|
|
||
| The company provides a security@company email address or submission form that manages vulnerabilities only. |
There was a problem hiding this comment.
Should we give companies some room for naming their delicate email addresses which is for managing vulnerabilities only? How about "The company provides a delicate email address or submission form that manages vulnerabilities only."
Added 3 indicators for a vulnerability disclosure program.