Responsible disclosure

Program rules

In order to protect our systems and users, we have compiled a list of rules regarding vulnerability disclosure:

• Only the systems within our scope are applicable.
• Report the vulnerability as quickly as possible after its discovery.
• Do not take advantage of the vulnerability or problem you have discovered. For example by downloading more data than necessary to demonstrate the vulnerability or by deleting or modifying other people’s data.
• Where applicable, you must only use your own data (name, email-address) to demonstrate the vulnerability.
  • The use of pseudonyms is allowed.
• Do not reveal the problem until it has been resolved.
• Avoid the following actions to keep the impact minimum:
  • Installing malware
  • Making changes to a system
  • Copying, changing or deleting data
• Overall, handle the knowledge on the security problem or vulnerability with care by not performing any acts other than those necessary to demonstrate the vulnerability.
• Please provide us with sufficient information to reproduce the problem, for example with a Proof-of-Concept, so we can resolve it as quickly as possible.
• When duplicate reports occur, we only award the first report that was received provided that it can be fully reproduced.

We ask that all disclosures are kept confidential in order to protect our community. Under very specific circumstances, and concerning major disclosures, we can foresee a common public communication. However, this must be agreed on beforehand at responsibledisclosure@on2it.net.