| 148 |
lars |
1 |
<!--
|
|
|
2 |
This policy template was created using the HackerOne Policy Builder [1],
|
|
|
3 |
with guidance from the National Telecommunications and Information
|
|
|
4 |
Administration Coordinated Vulnerability Disclosure Template [2].
|
|
|
5 |
-->
|
|
|
6 |
|
|
|
7 |
# Vulnerability Disclosure Policy (VDP)
|
|
|
8 |
|
|
|
9 |
## Brand Promise
|
|
|
10 |
|
|
|
11 |
<!--
|
|
|
12 |
This is your brand promise. Its objective is to "demonstrate a clear, good
|
|
|
13 |
faith commitment to customers and other stakeholders potentially impacted by
|
|
|
14 |
security vulnerabilities" [2].
|
|
|
15 |
-->
|
|
|
16 |
|
|
|
17 |
Keeping user information safe and secure is a top priority, and we welcome the
|
|
|
18 |
contribution of external security researchers.
|
|
|
19 |
|
|
|
20 |
## Scope
|
|
|
21 |
|
|
|
22 |
<!--
|
|
|
23 |
This is your initial scope. It tells vulnerability finders and reporters
|
|
|
24 |
"which systems and capabilities are 'fair game' versus 'off limits'" [2].
|
|
|
25 |
For software packages, this is often a list of currently maintained versions
|
|
|
26 |
of the package.
|
|
|
27 |
-->
|
|
|
28 |
|
|
|
29 |
If you believe you've found a security issue in software that is maintained in
|
|
|
30 |
this repository, we encourage you to notify us.
|
|
|
31 |
|
|
|
32 |
| Version | In scope | Source code |
|
|
|
33 |
| ------- | :------: | ----------- |
|
|
|
34 |
| latest | ✅ | https://github.com/ramsey/collection |
|
|
|
35 |
|
|
|
36 |
## How to Submit a Report
|
|
|
37 |
|
|
|
38 |
<!--
|
|
|
39 |
This is your communication process. It tells security researchers how to
|
|
|
40 |
contact you to report a vulnerability. It may be a link to a web form that
|
|
|
41 |
uses HTTPS for secure communication, or it may be an email address.
|
|
|
42 |
Optionally, you may choose to include a PGP public key, so that researchers
|
|
|
43 |
may send you encrypted messages.
|
|
|
44 |
-->
|
|
|
45 |
|
|
|
46 |
To submit a vulnerability report, please contact us at security@ramsey.dev.
|
|
|
47 |
Your submission will be reviewed and validated by a member of our team.
|
|
|
48 |
|
|
|
49 |
## Safe Harbor
|
|
|
50 |
|
|
|
51 |
<!--
|
|
|
52 |
This section assures vulnerability finders and reporters that they will
|
|
|
53 |
receive good faith responses to their good faith acts. In other words,
|
|
|
54 |
"we will not take legal action if..." [2].
|
|
|
55 |
-->
|
|
|
56 |
|
|
|
57 |
We support safe harbor for security researchers who:
|
|
|
58 |
|
|
|
59 |
* Make a good faith effort to avoid privacy violations, destruction of data, and
|
|
|
60 |
interruption or degradation of our services.
|
|
|
61 |
* Only interact with accounts you own or with explicit permission of the account
|
|
|
62 |
holder. If you do encounter Personally Identifiable Information (PII) contact
|
|
|
63 |
us immediately, do not proceed with access, and immediately purge any local
|
|
|
64 |
information.
|
|
|
65 |
* Provide us with a reasonable amount of time to resolve vulnerabilities prior
|
|
|
66 |
to any disclosure to the public or a third party.
|
|
|
67 |
|
|
|
68 |
We will consider activities conducted consistent with this policy to constitute
|
|
|
69 |
"authorized" conduct and will not pursue civil action or initiate a complaint to
|
|
|
70 |
law enforcement. We will help to the extent we can if legal action is initiated
|
|
|
71 |
by a third party against you.
|
|
|
72 |
|
|
|
73 |
Please submit a report to us before engaging in conduct that may be inconsistent
|
|
|
74 |
with or unaddressed by this policy.
|
|
|
75 |
|
|
|
76 |
## Preferences
|
|
|
77 |
|
|
|
78 |
<!--
|
|
|
79 |
The preferences section sets expectations based on priority and submission
|
|
|
80 |
volume, rather than legal objection or restriction [2].
|
|
|
81 |
|
|
|
82 |
According to the NTIA [2]:
|
|
|
83 |
|
|
|
84 |
This section is a living document that sets expectations for preferences
|
|
|
85 |
and priorities, typically maintained by the support and engineering
|
|
|
86 |
team. This can outline classes of vulnerabilities, reporting style
|
|
|
87 |
(crash dumps, CVSS scoring, proof-of-concept, etc.), tools, etc. Too
|
|
|
88 |
many preferences can set the wrong tone or make reporting findings
|
|
|
89 |
difficult to navigate. This section also sets expectations to the
|
|
|
90 |
researcher community for what types of issues are considered important
|
|
|
91 |
or not.
|
|
|
92 |
-->
|
|
|
93 |
|
|
|
94 |
* Please provide detailed reports with reproducible steps and a clearly defined
|
|
|
95 |
impact.
|
|
|
96 |
* Include the version number of the vulnerable package in your report
|
|
|
97 |
* Social engineering (e.g. phishing, vishing, smishing) is prohibited.
|
|
|
98 |
|
|
|
99 |
<!--
|
|
|
100 |
References
|
|
|
101 |
|
|
|
102 |
[1] HackerOne. Policy builder. Retrieved from https://hackerone.com/policy-builder/
|
|
|
103 |
|
|
|
104 |
[2] NTIA Safety Working Group. 2016. "Early stage" coordinated vulnerability
|
|
|
105 |
disclosure template: Version 1.1. (15 December 2016). Retrieved from
|
|
|
106 |
https://www.ntia.doc.gov/files/ntia/publications/ntia_vuln_disclosure_early_stage_template.pdf
|
|
|
107 |
-->
|
|
|
108 |
|
|
|
109 |
## Encryption Key for security@ramsey.dev
|
|
|
110 |
|
|
|
111 |
For increased privacy when reporting sensitive issues, you may encrypt your
|
|
|
112 |
message using the following public key:
|
|
|
113 |
|
|
|
114 |
```
|
|
|
115 |
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
|
|
116 |
|
|
|
117 |
mQINBF+Z9gEBEACbT/pIx8RR0K18t8Z2rDnmEV44YdT7HNsMdq+D6SAlx8UUb6AU
|
|
|
118 |
jGIbV9dgBgGNtOLU1pxloaJwL9bWIRbj+X/Qb2WNIP//Vz1Y40ox1dSpfCUrizXx
|
|
|
119 |
kb4p58Xml0PsB8dg3b4RDUgKwGC37ne5xmDnigyJPbiB2XJ6Xc46oPCjh86XROTK
|
|
|
120 |
wEBB2lY67ClBlSlvC2V9KmbTboRQkLdQDhOaUosMb99zRb0EWqDLaFkZVjY5HI7i
|
|
|
121 |
0pTveE6dI12NfHhTwKjZ5pUiAZQGlKA6J1dMjY2unxHZkQj5MlMfrLSyJHZxccdJ
|
|
|
122 |
xD94T6OTcTHt/XmMpI2AObpewZDdChDQmcYDZXGfAhFoJmbvXsmLMGXKgzKoZ/ls
|
|
|
123 |
RmLsQhh7+/r8E+Pn5r+A6Hh4uAc14ApyEP0ckKeIXw1C6pepHM4E8TEXVr/IA6K/
|
|
|
124 |
z6jlHORixIFX7iNOnfHh+qwOgZw40D6JnBfEzjFi+T2Cy+JzN2uy7I8UnecTMGo3
|
|
|
125 |
5t6astPy6xcH6kZYzFTV7XERR6LIIVyLAiMFd8kF5MbJ8N5ElRFsFHPW+82N2HDX
|
|
|
126 |
c60iSaTB85k6R6xd8JIKDiaKE4sSuw2wHFCKq33d/GamYezp1wO+bVUQg88efljC
|
|
|
127 |
2JNFyD+vl30josqhw1HcmbE1TP3DlYeIL5jQOlxCMsgai6JtTfHFM/5MYwARAQAB
|
|
|
128 |
tBNzZWN1cml0eUByYW1zZXkuZGV2iQJUBBMBCAA+FiEE4drPD+/ofZ570fAYq0bv
|
|
|
129 |
vXQCywIFAl+Z9gECGwMFCQeGH4AFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ
|
|
|
130 |
q0bvvXQCywIkEA//Qcwv8MtTCy01LHZd9c7VslwhNdXQDYymcTyjcYw8x7O22m4B
|
|
|
131 |
3hXE6vqAplFhVxxkqXB2ef0tQuzxhPHNJgkCE4Wq4i+V6qGpaSVHQT2W6DN/NIhL
|
|
|
132 |
vS8OdScc6zddmIbIkSrzVVAtjwehFNEIrX3DnbbbK+Iku7vsKT5EclOluIsjlYoX
|
|
|
133 |
goW8IeReyDBqOe2H3hoCGw6EA0D/NYV2bJnfy53rXVIyarsXXeOLp7eNEH6Td7aW
|
|
|
134 |
PVSrMZJe1t+knrEGnEdrXWzlg4lCJJCtemGv+pKBUomnyISXSdqyoRCCzvQjqyig
|
|
|
135 |
2kRebUX8BXPW33p4OXPj9sIboUOjZwormWwqqbFMO+J4TiVCUoEoheI7emPFRcNN
|
|
|
136 |
QtPJrjbY1++OznBc0GRpfeUkGoU1cbRl1bnepnFIZMTDLkrVW6I1Y4q8ZVwX3BkE
|
|
|
137 |
N81ctFrRpHBlU36EdHvjPQmGtuiL77Qq3fWmMv7yTvK1wHJAXfEb0ZJWHZCbck3w
|
|
|
138 |
l0CVq0Z+UUAOM8Rp1N0N8m92xtapav0qCFU9qzf2J5qX6GRmWv+d29wPgFHzDWBm
|
|
|
139 |
nnrYYIA4wJLx00U6SMcVBSnNe91B+RfGY5XQhbWPjQQecOGCSDsxaFAq2MeOVJyZ
|
|
|
140 |
bIjLYfG9GxoLKr5R7oLRJvZI4nKKBc1Kci/crZbdiSdQhSQGlDz88F1OHeCIdQQQ
|
|
|
141 |
EQgAHRYhBOhdAxHd+lus86YQ57Atl5icjAcbBQJfmfdIAAoJELAtl5icjAcbFVcA
|
|
|
142 |
/1LqB3ZjsnXDAvvAXZVjSPqofSlpMLeRQP6IM/A9Odq0AQCZrtZc1knOMGEcjppK
|
|
|
143 |
Rk+sy/R0Mshy8TDuaZIRgh2Ux7kCDQRfmfYBARAAmchKzzVz7IaEq7PnZDb3szQs
|
|
|
144 |
T/+E9F3m39yOpV4fEB1YzObonFakXNT7Gw2tZEx0eitUMqQ/13jjfu3UdzlKl2bR
|
|
|
145 |
qA8LrSQRhB+PTC9A1XvwxCUYhhjGiLzJ9CZL6hBQB43qHOmE9XJPme90geLsF+gK
|
|
|
146 |
u39Waj1SNWzwGg+Gy1Gl5f2AJoDTxznreCuFGj+Vfaczt/hlfgqpOdb9jsmdoE7t
|
|
|
147 |
3DSWppA9dRHWwQSgE6J28rR4QySBcqyXS6IMykqaJn7Z26yNIaITLnHCZOSY8zhP
|
|
|
148 |
ha7GFsN549EOCgECbrnPt9dmI2+hQE0RO0e7SOBNsIf5sz/i7urhwuj0CbOqhjc2
|
|
|
149 |
X1AEVNFCVcb6HPi/AWefdFCRu0gaWQxn5g+9nkq5slEgvzCCiKYzaBIcr8qR6Hb4
|
|
|
150 |
FaOPVPxO8vndRouq57Ws8XpAwbPttioFuCqF4u9K+tK/8e2/R8QgRYJsE3Cz/Fu8
|
|
|
151 |
+pZFpMnqbDEbK3DL3ss+1ed1sky+mDV8qXXeI33XW5hMFnk1JWshUjHNlQmE6ftC
|
|
|
152 |
U0xSTMVUtwJhzH2zDp8lEdu7qi3EsNULOl68ozDr6soWAvCbHPeTdTOnFySGCleG
|
|
|
153 |
/3TonsoZJs/sSPPJnxFQ1DtgQL6EbhIwa0ZwU4eKYVHZ9tjxuMX3teFzRvOrJjgs
|
|
|
154 |
+ywGlsIURtEckT5Y6nMAEQEAAYkCPAQYAQgAJhYhBOHazw/v6H2ee9HwGKtG7710
|
|
|
155 |
AssCBQJfmfYBAhsMBQkHhh+AAAoJEKtG7710AssC8NcP/iDAcy1aZFvkA0EbZ85p
|
|
|
156 |
i7/+ywtE/1wF4U4/9OuLcoskqGGnl1pJNPooMOSBCfreoTB8HimT0Fln0CoaOm4Q
|
|
|
157 |
pScNq39JXmf4VxauqUJVARByP6zUfgYarqoaZNeuFF0S4AZJ2HhGzaQPjDz1uKVM
|
|
|
158 |
PE6tQSgQkFzdZ9AtRA4vElTH6yRAgmepUsOihk0b0gUtVnwtRYZ8e0Qt3ie97a73
|
|
|
159 |
DxLgAgedFRUbLRYiT0vNaYbainBsLWKpN/T8odwIg/smP0Khjp/ckV60cZTdBiPR
|
|
|
160 |
szBTPJESMUTu0VPntc4gWwGsmhZJg/Tt/qP08XYo3VxNYBegyuWwNR66zDWvwvGH
|
|
|
161 |
muMv5UchuDxp6Rt3JkIO4voMT1JSjWy9p8krkPEE4V6PxAagLjdZSkt92wVLiK5x
|
|
|
162 |
y5gNrtPhU45YdRAKHr36OvJBJQ42CDaZ6nzrzghcIp9CZ7ANHrI+QLRM/csz+AGA
|
|
|
163 |
szSp6S4mc1lnxxfbOhPPpebZPn0nIAXoZnnoVKdrxBVedPQHT59ZFvKTQ9Fs7gd3
|
|
|
164 |
sYNuc7tJGFGC2CxBH4ANDpOQkc5q9JJ1HSGrXU3juxIiRgfA26Q22S9c71dXjElw
|
|
|
165 |
Ri584QH+bL6kkYmm8xpKF6TVwhwu5xx/jBPrbWqFrtbvLNrnfPoapTihBfdIhkT6
|
|
|
166 |
nmgawbBHA02D5xEqB5SU3WJu
|
|
|
167 |
=eJNx
|
|
|
168 |
-----END PGP PUBLIC KEY BLOCK-----
|
|
|
169 |
```
|