Vulnerability Reporting
To help us respond effectively, please share any supporting materials (e.g., proof-of-concept code, tool output) that clarify the nature and severity of the vulnerability.
Vulnerability Reporting
To help us respond effectively, please share any supporting materials (e.g., proof-of-concept code, tool output) that clarify the nature and severity of the vulnerability.
Vulnerability Reporting
Here are some demo section description texts
you can use as placeholders
GovDash is committed to being responsive and keeping you informed of our progress. You will receive a non-automated response confirming receipt of your initial report within 24 hours, timely updates, and monthly check-ins throughout the engagement. You may request updates at any time, and we welcome dialogue that clarifies any concern or disclosure coordination.
The activities deemed not a vulnerability above are also out of scope for the GovDash Vulnerability Disclosure Program. Conducting any of the activities mentioned above will result in disqualification from the program permanently.
Public Notification
Here are some demo section description texts
you can use as placeholders
If applicable, AWS will coordinate public notification of any validated vulnerability with you. Where possible, we prefer that our respective public disclosures be posted simultaneously.
In order to protect our customers, AWS requests that you not post or share information about a potential vulnerability in any public setting until we have addressed the reported vulnerability and informed customers if necessary. Also, we respectfully ask that you do not post or share any data belonging to our customers. Please note, the time required to mitigate a vulnerability is dependent upon the severity of the vulnerability and the affected systems.
AWS makes public notifications in the form of Security Bulletins, which are posted in the AWS Security website. Individuals, companies, and security teams typically post their advisories on their own websites and in other forums and when relevant, we will include links to those third-party resources in AWS Security Bulletins.
Disclosure Policy
Here are some demo section description texts
you can use as placeholders
Once the report has been submitted, we will work to validate the reported vulnerability. If additional information is required to validate or reproduce the issue, we will work with you to obtain it. When the initial investigation is complete, results will be delivered to you along with a plan for resolution and discussion of public disclosure.
A few things to note about the process:
Third-Party Products: If the vulnerability is found to affect a third-party product, we will notify the owner of the affected technology. We will continue to coordinate between you and the third party. Your identity will not be disclosed to the third party without your permission.
Confirmation of Non-Vulnerabilities: If the issue cannot be validated, or is not found to be in scope, this will be shared with you.
Vulnerability Classification: We use version 3.1 of the Common Vulnerability Scoring System (CVSS) to evaluate potential vulnerabilities. The resulting score helps quantify the severity of the issue and to prioritize our response. For more information on CVSS, please reference the NVD site.
In participating in our vulnerability disclosure program in good faith, we ask that you:
Play by the rules, including following this policy and any other relevant agreements. If there is any inconsistency between this policy and any other applicable terms, the terms of this policy will prevail;
Report any vulnerability you’ve discovered promptly;
Avoid violating the privacy of others, disrupting our systems, destroying data, and/or harming user experience;Use only the previously mentioned channels to discuss vulnerability information with us;
rovide us a reasonable amount of time from the initial report to resolve the issue before you disclose it publicly;
Perform testing only on in-scope systems, and respect systems and activities which are out-of-scope;
If a vulnerability provides unintended access to data: Limit the amount of data you access to the minimum required for effectively demonstrating a proof-of-concept; and cease testing and submit a report immediately if you encounter any user data during testing, such as Personally Identifiable Information (PII), Personal Healthcare Information (PHI), credit card data, or proprietary information;
Only interact with test accounts you own or with explicit permission from the account holder; and
Do not engage in extortion.