Vulnerability Disclosure Program

Purpose

Auvik looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.

Vulnerability Disclosure Program

Our VDP is a public program where security researchers can submit their findings through HackerOne. More information can be found here.

Reporting Process

To report a security vulnerability to Auvik, email us at [email protected]. You will receive an auto-response email notifying you that Auvik uses the HackerOne platform for our vulnerability disclosure program. Click on the ‘Submit Vulnerability Report’ link to report your findings. Create a HackerOne account if you don’t already have one. If you already have a HackerOne account, please login using your existing credentials. Upon signing in, you will now be able to submit your vulnerability report. Please include the following information with your submission.

Issue Summary: Please include a brief summary of the bug in two sentences or less. Replication Steps: We’ll try to reproduce the bug so please tell us exactly what you were doing

When you experienced the issue – the more specific the better!

Supporting Material/References: List any materials such as screenshots, logs, and so on to support your findings.

Expected Outcome: Sometimes it’s not obvious what the issue is, even if we can reproduce it. Please tell us what you were expecting to happen.

Program Scope

*.auvik.com

Rewards

The vulnerability disclosure program is not eligible for rewards.

Disclosure Policy

• You may not discuss these programs or any vulnerabilities (even invalid and resolved ones) outside of the program without express consent from the organization. If you are interested in sharing any information about your testing methodology related to an Auvik report, you must request permission on your report and you must receive written approval from an Auvik team member.
• You may not perform denial of service attacks or any other attacks that may cause privacy violations, interruption or degradation of any Auvik services, or destruction of data.
• You may not spam any web contact forms regarding vulnerabilities. Please follow the reporting process, as mentioned above, for submitting any vulnerabilities.
• You may not send vulnerability submissions to any Auvik email addresses other than [email protected]. Failure to comply will result in a warning and any instances thereafter will result in your email account being blocked.
• You may not download, modify, or delete any data that does not belong to you.

Legal

Auvik reserves the right to modify the terms and conditions of this program, and your participation in the Program constitutes acceptance of all terms. Please check this site regularly as we routinely update our program terms and eligibility, which are effective upon posting.