Vulnerability Disclosure Program

Intrado's Vulnerability Disclosure Policy

Out of Scope:

  • Banner/version disclosure

  • Insecure SSL or TLS issues (e.g., ciphers, certificates, etc.)

  • Security headers suggestions (e.g., HTTP Strict-Transport-Security (HSTS), Content Security Policy (CSP), etc.)

  • SPF / DMARC / DKIM / DNSSEC suggestions

  • Host header injections unless you can show how they can lead to stealing data

  • Content spoofing or text injection

  • Insecure cookie settings for non-sensitive cookies

  • Use of a known-vulnerable library without evidence of exploitability

  • Reports from automated tools or scans without accompanying demonstration of exploitability

  • Software version disclosure without accompanying demonstration of exploitability

  • Direct testing of 3rd parties

  • Disruptive testing, including:

    • DoS / DDoS attacks

    • TDoS attacks

    • Social engineering-based attacks (i.e., phishing, spam, vishing, etc.)

    • Attacks via user devices