Vulnerability Disclosure Program

Vulnerability Disclosure Policy

1. All of your findings must be submitted through the Vulnerability Disclosure Program.
2. Ensure that the potential security bug you are reporting is in scope as specified by the “Scope” section below.
3. For security reasons, do not share your findings with anyone other than DFINITY. All of your findings have to be treated as confidential for a period of time until the security team is able to fix the bug.
4. The testing activities that you conduct must be limited to showing that a potential vulnerability exists.
5. Provide clear technical details explaining the attack scenario, method of exploitation, steps to reproduce, and security impact.
6. Provide details on how you uncovered the issue, the situational sequence that led to the finding, and your suggestions for remediation.
7. Submit relevant logs, proof-of-concept code, documents, screenshots, and recordings of the vulnerability, along with the details of the environment you were working on while discovering the issue.
8. In cases where you find an issue but don’t have the time or the resources to carry out a complete investigation, provide any information that you have at hand. Include a note saying that you could not complete your investigation, and provide details on how to continue the investigation further.
9. Submit your report and artifacts via the Vulnerability Disclosure Program intake form.
10. Do not use automated testing tools to look for vulnerabilities.
11. Do not engage in social engineering techniques or spear-phishing campaigns.
12. Do not undertake Denial-of-Service (DOS) testing.
13. Do not exfiltrate data under any circumstances.
14. Any accidental disclosures of sensitive data and information that result from testing activities must be disclosed to DFINITY.
15. Bugs in third-party code are strictly excluded from scope.
16. Public disclosure of the vulnerability without abiding by this policy makes it ineligible for rewards.
17. If the same issue is reported by different researchers during a 48-hour window, it will result in the reward being split equally between them.
18. If a bug was already reported, it will be ineligible for rewards after the 48-hour window.
19. DFINITY Foundation employees and those of its subsidiaries and affiliates are ineligible for rewards.
20. At this point in time, the rewards are reserved only for critical bugs identified in the Internet Computer that can affect its operation and stability.
21. The DFINITY team will evaluate the severity of the reported bugs and allocate the appropriate reward. The rewards will depend solely on the team’s discretion.

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.