Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Vulnerabiltiy disclosure program.yaml #110

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Update Vulnerabiltiy disclosure program.yaml #110

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6656210
Update Vulnerability disclosure program.yaml
pumzi Jan 30, 2019
1086ca5
Merge pull request #1 from SelinaMusuta/SelinaMusuta-vulnerabilities-…
pumzi Jan 30, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions Security (Is it safe?)/Data security/Vulnerability disclosure program.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,13 @@ criterias:
- indicator: >+
The company has a mechanism (ex: a bug bounty program) through which security researchers can
submit vulnerabilities they discover.

A company with a bug bounty program has an alternative mechanism to report vulnerabilities that non-technical
consumers can use to report vulnerabilities.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of asking conpanies for having a vulnerability report portal for non-technical consumers, is it ok to say that A company with a bug bounty program has an alternative mechanism to report bugs that non-technical consumers can use.


The company provides a clear description with examples of what is defined as a security vulnerability.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We probably don't want companies to define security vulnerability. So, security researchers can report any finding or concern they have to companies. @billfitzg @mrerecich @stephtngu-CR


The company provides a security@company email address or submission form that manages vulnerabilities only.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we give companies some room for naming their delicate email addresses which is for managing vulnerabilities only? How about "The company provides a delicate email address or submission form that manages vulnerabilities only."


The company discloses the timeframe in which it will review reports of
vulnerabilities.
Expand Down