The Vulnerability Disclosure Program is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey Abrigo’s preferences in how to submit discovered vulnerabilities.
Abrigo encourages outside parties and security researcher to submit reports to Abrigo regarding potential vulnerabilities in Abrigo systems and platforms.
Authorization
Security researchers making a good faith effort to comply with this Program during their research will be considered authorized. Abrigo will work with any such security researcher to understand and resolve the issue, and Abrigo will not recommend or pursue legal action related to such research. Should legal action be initiated by a third party against the security researcher for activities conducted in accordance with this Program, Abrigo will make this authorization known.
Guidelines
Under this Program, “research” means activities in which an outside party:
- Notifies Abrigo as soon as possible upon discovery of an actual or potential security issue
- Makes every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data
- Only uses exploits to the extent necessary to confirm the presence of a vulnerability, and does not use an exploit to compromise or exfiltrate data, establish persistent command line access, or use the exploit to pivot to other systems.
- Provides Abrigo with a reasonable amount of time before disclosing identified vulnerabilities publicly
- Does not submit a high volume of low-quality reports
Security researchers that have established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets) should stop testing, notify Abrigo immediately, and refrain from disclosing this data to anyone else.
Test Methods
The following test methods are not authorized:
- Network or application denial of service (DoS) tests, distributed denial of service (DDoS) tests, or other tests that impair access to or otherwise damage a system or data
- Physical testing (e.g., office access, datacenter access, open doors, tailgating), social engineering (e.g., phishing, vishing), or any other non-technical vulnerability testing
Scope
Applications & Systems
This Program applies to specific applications and systems shown as “Included” in the table below. Websites that are not used to provide products or services to customers, or are otherwise deemed low risk to Abrigo, are intentionally noted as “Excluded” from scope.
