Responsible Vulnerability Disclosure Policy

Authentic8 believes effective disclosure of security vulnerabilities requires mutual trust, respect, transparency, and common good between Authentic8 and Security Researchers. This policy is meant to give security researchers clear guidelines for conducting vulnerability discovery activities and submitting discovered vulnerabilities reports to Authentic8. By conducting vulnerability research activities, you agree to and are bound to the terms and conditions detailed in this page. These terms are governed by Delaware law and constitute the entirety of the agreement between you and Authentic8. Any changes to the terms in this policy must be made in writing and agreed upon by both parties.

Security Researchers

Authentic8 accepts vulnerability reports from independent security researchers, industry partners, vendors, customers, and consultants. Authentic8 defines a security vulnerability as an unintended weakness or exposure that could be used to compromise the integrity, availability or confidentiality of our products and services.

Guidelines

This policy defines “Security Research” as activity that is meant to identify and confirm a security vulnerability and which:

• Is disclosed to Authentic8 as soon as possible after a security issue or vulnerability is discovered
• Is conducted with every effort to avoid privacy violations, degradation of user experience, disruption to Authentic8 systems or services, and destruction or manipulation of data;
• COMPLIES WITH THE TERMS OF THIS RESPONSIBLE VULNERABILITY DISCLOSURE POLICY;
• Does not compromise the privacy or safety of Authentic8 customers, contractors, or employees;
• Does not modify or exfiltrate Authentic8 system data or customer or user data;
• Does not establish command line access and/or persistence; and
• Does not involve the researcher pivoting from one system to another.

Upon discovery of a security vulnerability or sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), you must:

• Stop all research activity;
• Immediately notify Authentic8 (in accordance with the Section titled "Reporting a Vulnerability" below); and
• Not disclose your findings to anyone else.

Prohibited Test Methods

The following test methods are not authorized unless permitted via a specific Authentic8 engagement and an accompanying, signed agreement between Authentic8 and the Security Researcher(s):

• Network denial of service (DoS or DDoS) tests
• Usage of dynamic vulnerability scanning tools that perform crawling or fuzzing
• Physical testing (e.g., office access, tailgating, etc.)
• Social engineering (e.g., phishing, vishing, etc.)

Scope

Service-affecting testing is not authorized on any domain, service, or property of Authentic8 unless permitted via a specific engagement and an accompanying Authentic8-signed agreement.

In-Scope Services and Domains*
Authentic8 Silo (SaaS)
authentic8.com
a8silo.com
getsilo.com

 

 

 

 

*Includes Security Research in accordance with this Policy and expressly excludes any service-
affecting testing.

Authentic8 encourages security researchers to use this program to responsibly disclose any incidentally discovered security vulnerabilities and exposures that are applicable to the domains, sub-domains, and services listed above. Websites and services that are not listed here are considered out of scope for this policy. Vulnerabilities that are discovered in non-Authentic8 systems and/or which are specifically attributable to our sub-processors (https://www.authentic8.com/third-party-processors) are out-of-scope and should be reported directly to the vendor according to their disclosure policy. 

Security Researchers

• Security researchers must stop testing and notify Authentic8 immediately upon discovery of a vulnerability
• Security researchers must stop testing and notify Authentic8 immediately upon discovery of exposed nonpublic data
• Security researchers must delete any stored Authentic8 nonpublic data immediately after reporting a vulnerability
• Security researchers must not test any system other than those identified in the Scope section above
• Security researchers must not disclose vulnerability information except as identified in the “Reporting a Vulnerability” section below
• Security researchers must not engage in physical testing of facilities or resources
• Security researchers must not engage in social engineering
• Security researchers must not send unsolicited electronic mail to Authentic8 customers or employees, including “phishing” messages
• Security researchers must not execute or attempt to execute “denial of service” attacks of any kind
• Security researchers must not introduce malicious software to Authentic8 systems, domains, or services
• Security researchers must not test in a manner that could degrade, impair, disrupt, or disable any portion of Authentic8’s systems or services; this includes a prohibition of dynamic vulnerability scanning tools that perform crawling or fuzzing 
• Security researchers must not test third-party systems, services, applications, or websites that are leveraged by or integrate with Authentic8 systems
• Security researchers must not modify, delete, retain, obstruct, or share Authentic8 data or Authentic8 customer data 
• Security researchers must not use an exploit to exfiltrate data, establish command line access, establish a persistent presence on Authentic8 systems or services, or "pivot" to other Authentic8 systems

Reporting a Vulnerability

Authentic8 accepts vulnerability reports that are submitted via the form included on this page. We do not support reports that are submitted via e-mail. 

Information submitted under this policy will be used to mitigate or remediate vulnerabilities. Depending on the scope of your findings, Authentic8 may share your report with third parties at its discretion. This includes, but is not limited to, the U.S. Cybersecurity and Infrastructure Security Agency, contracted cybersecurity vendors, and Authentic8 customers. 

By clicking “Report vulnerability” in the form on this page, you are indicating that you have read, understand, and agree to the guidelines described in this policy for the conduct of security research and disclosure of vulnerabilities or indicators of vulnerabilities related to Authentic8 systems, and consent to having the contents of the communication and follow-up communication stored in Authentic8 systems and any systems or services that are leveraged by Authentic8 (i.e., Bugcrowd). Because Authentic8 leverages Bugcrowd services for vulnerability report submissions, your submission must also adhere to their terms and conditions. 

General

Authentic8 reserves the right to change, remove, or modify the terms and conditions of this policy at any time, with or without notice. Before sending each submission, please review the terms of this policy to ensure full compliance.

Authentic8 cannot guarantee any response or remuneration for reported vulnerabilities. 

---