Legal Agreements

Coordinated Vulnerability Disclosure Policy

« Back to Legal Agreements Index
Last Revised: July 28, 2019, Written by
Coordinated Vulnerability Disclosure

D8TA.CENTER encourages researchers to work with us on potential issues in our services or on our website. In order to encourage researchers to work with us, we agree that if, in our sole discretion, we conclude that a disclosure meets all of the guidelines of the D8TA.CENTER Coordinated Disclosure policy, D8TA.CENTER will not bring any private or criminal legal action against the disclosing party.

Non-Qualifying Vulnerabilities

Any domain not contained within D8TA.CENTER is out of scope for the purposes of the Coordinated Vulnerability Disclosure, as is all hosted customer content and third-party programs and plug-ins.

The following actions do not qualify for Coordinated Disclosure and should not be tested by researchers participating in the Program:

  • DoS, brute force, user enumeration or DDoS attacks
  • Physical attacks
  • Phishing attacks
  • Any bug that relies on Social engineering
  • CRIME/BEAST attacks
  • Logout CSRF
  • Banner or version disclosures
  • Missing SPF records
  • Directory listing (unless sensitive data can be found)
  • Blackhat SEO techniques
  • Any bug that relies upon an outdated browser

D8TA.CENTER will not accept reports from automated vulnerability scanners.

Qualifying Vulnerabilities

D8TA.CENTER will accept a report of any vulnerability that substantially affects the confidentiality or integrity of any eligible D8TA.CENTER service. Eligible vulnerabilities include, but are not limited to: * Cross Site Scripting (XSS) * Authentication and Authorization Flaws * Cross Site Request Forgery (CSRF) * Remote Code Execution * SQL Injection * Directory Traversal * Click-jacking * Privilege Escalation

Suggestions for Good Reports
  1. The more detailed your steps for reproducing the bug, the better. This should include any pages that you visited, user IDs, links clicked, etc.
  2. Videos and images are always useful but are even more useful if accompanied by a description.
  3. Exploit code that consistently works can allow us to verify your vulnerability more quickly.
  4. Remember – details, details, details!
Confidentiality

Any information that you collect about D8TA.CENTER, D8TA.CENTER employees, or D8TA.CENTER customers (“Confidential Information”) through the Coordinated Vulnerability Disclosure program must be kept confidential and may only be used in connection with the Program. You may disclose vulnerabilities only after proper remediation has occurred and you may not disclose Confidential Information without D8TA.CENTER’s prior written consent. Any disclosure of Confidential Information outside of this requirement will result in immediate removal from the Program.

Legal

By participating in D8TA.CENTER ‘s Coordinated Vulnerability Disclosure, you acknowledge that you have read and agree to D8TA.CENTER’s Universal Terms of Service Agreement and Privacy Policy.

Your testing must not violate any law, disrupt services, or compromise any data that is not your own.