Vulnerability Disclosure Program

Purpose

Auvik recognizes that the security community is a force multiplier in our quest to provide a safe and secure experience for Auvik’s customers. To that end, we welcome the contributions of security researchers and strive to provide the best vulnerability disclosure experience possible. Auvik looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.

Vulnerability Disclosure Program

Our VDP is a public program where security researchers can submit their findings directly to us. Auvik understands the value of working with the security researcher community to ensure that bugs and vulnerabilities are remediated to improve our security and to keep the web a safer place.

Reporting Process

To report a security vulnerability to Auvik, email us at [email protected]. Please include the following information with your submission.

Issue Summary: Please include a brief summary of the bug in two sentences or less.

Replication Steps: We’ll try to reproduce the bug so please tell us exactly what you were doing. When you experience the issue – the more specific the better!

Supporting Material/References: List any materials such as screenshots, logs, and so on to support your findings.

Expected Outcome: Sometimes it’s not obvious what the issue is, even if we can reproduce it. Please tell us what you were expecting to happen.

Program Scope

*.auvik.com
www.saaslio.com
app.saaslio.com
demo.saaslio.com

Rewards

The vulnerability disclosure program is not eligible for rewards.

Disclosure Policy

You may not discuss these programs or any vulnerabilities (even invalid and resolved ones) outside of the program without express consent from the organization. If you are interested in sharing any information about your testing methodology related to an Auvik report, you must request permission on your report and you must receive written approval from an Auvik team member.
You may not perform denial of service attacks or any other attacks that may cause privacy violations, interruption or degradation of any Auvik services, or destruction of data.
You may not spam any web contact forms regarding vulnerabilities. Please follow the reporting process, as mentioned above, for submitting any vulnerabilities.
You may not send vulnerability submissions to any Auvik email addresses other than [email protected]. Failure to comply will result in a warning and any instances thereafter will result in your email account being blocked.
You may not download, modify, or delete any data that does not belong to you.

Rules

Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, we may not be able to triage.
Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
Do not spam web contact forms or perform high volume scans that may interrupt services.
Ensure the URL you are scanning is considered in scope. Please refer to the program scope sections above.
When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).
Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
Please do not engage in any activity that can potentially or actually cause harm to our customers, or our employees.
Do not engage in any activity that violates (a) federal or state laws or regulations or (b) the laws or regulations of any country where (i) data, assets, or systems reside, (ii) data traffic is routed, or (iii) the researcher is conducting research activity.
Do not store, share, compromise, or destroy customer data. If Personally Identifiable Information (PII) is encountered, you should immediately halt your activity, purge related data from your system, and immediately contact Auvik. This step protects any potentially vulnerable data, and you.

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Legal

Auvik reserves the right to modify the terms and conditions of this program, and your participation in the Program constitutes acceptance of all terms. Please check this site regularly as we routinely update our program terms and eligibility, which are effective upon posting.

Thank you for helping keep Auvik and our users safe