At VanCorp, we take the security of our systems and the privacy of our users very seriously. We are committed to maintaining the highest standards of cybersecurity and appreciate the valuable contributions of security researchers and the broader community in identifying potential vulnerabilities. This Responsible Disclosure page outlines how you can report security vulnerabilities to us, our commitment to addressing them, and the guidelines for responsible disclosure.
1. Our Commitment to Security
VanCorp is committed to safeguarding the data and systems that power our operations. We continuously work to enhance our security measures and promptly address any vulnerabilities that are identified. We recognize that no system is completely secure, and we welcome the responsible disclosure of security vulnerabilities by ethical hackers and security researchers.
Key Points:
Security Focus: Prioritize the protection of our systems and user data.
Continuous Improvement: Regularly update and strengthen our security measures.
Open Collaboration: Encourage security researchers to report vulnerabilities responsibly.
2. Reporting a Vulnerability
If you have discovered a security vulnerability in VanCorp’s systems, we encourage you to report it to us responsibly. To ensure that the vulnerability is addressed effectively, please follow these steps:
Contact Information: Send your findings to our dedicated security team via email at info@thevancorp.com.
Detailed Description: Provide a detailed description of the vulnerability, including the potential impact and steps to reproduce it.
Supporting Evidence: Include any supporting evidence, such as screenshots, proof-of-concept code, or logs, to help us understand the issue.
Key Points:
Direct Reporting: Use the provided email address to report security vulnerabilities.
Comprehensive Details: Offer a clear and detailed explanation of the vulnerability.
Proof and Documentation: Include evidence to support your findings.
3. Guidelines for Responsible Disclosure
To protect our users and systems, we ask that you adhere to the following guidelines when reporting vulnerabilities:
No Disruption: Avoid exploiting the vulnerability for any reason beyond testing, and do not disrupt our services or access non-public data.
Confidentiality: Keep the details of the vulnerability confidential until we have had an opportunity to address it.
Legal Compliance: Ensure that your actions comply with all applicable laws and regulations. Unauthorized access to data, systems, or networks is illegal.
Key Points:
Non-Disruptive Testing: Do not engage in activities that could harm our systems or users.
Confidentiality Agreement: Maintain confidentiality until the issue is resolved.
Legal Conduct: Ensure all actions are lawful and ethical.
4. What to Expect After Reporting
Once you have reported a vulnerability to us, we will take the following steps:
Acknowledgment: We will acknowledge receipt of your report within a reasonable timeframe.
Investigation: Our security team will investigate the reported vulnerability and assess its impact.
Resolution: If the vulnerability is confirmed, we will work to resolve the issue as quickly as possible.
Notification: We will keep you informed of the progress and notify you when the issue has been addressed.
Key Points:
Timely Response: Acknowledge and investigate reports promptly.
Thorough Analysis: Carefully evaluate the vulnerability and its potential impact.
Resolution and Updates: Provide updates throughout the process and notify you upon resolution.
5. Recognition and Rewards
We value the efforts of ethical hackers and security researchers in helping us maintain the security of our systems. While we do not offer monetary rewards, we may recognize your contribution publicly if you wish, provided the vulnerability is responsibly disclosed and does not violate our guidelines.
Key Points:
Public Recognition: Offer recognition to those who responsibly disclose vulnerabilities.
No Monetary Rewards: Acknowledge contributions without offering financial compensation.
Optional Anonymity: Respect your preference for anonymity if requested.
6. Scope of the Responsible Disclosure Program
Our Responsible Disclosure Program covers a wide range of VanCorp systems and services, but it does not include certain activities that are out of scope. These include:
Out-of-Scope Areas: Non-production systems, third-party services not controlled by VanCorp, social engineering, and physical security vulnerabilities.
Prohibited Actions: Attempts to access personal data, denial-of-service attacks, and any actions that could cause harm to VanCorp or its users.
Key Points:
Defined Scope: Clearly outline the areas covered by our disclosure program.
Exclusions: Identify activities that are outside the scope of the program.
Responsible Conduct: Ensure actions do not harm users or systems.
7. Legal Safe Harbor
VanCorp is committed to working with security researchers who follow this Responsible Disclosure policy in good faith. If you comply with this policy while investigating and reporting a vulnerability, we will consider your actions authorized and will not pursue legal action against you.
Key Points:
Good Faith Protection: Offer legal safe harbor to researchers who follow our guidelines.
Authorized Testing: Recognize responsible vulnerability testing as authorized.
No Legal Action: Refrain from legal action against compliant researchers.
8. Contact Us
If you have any questions about this Responsible Disclosure policy or need further clarification, please contact us at info@thevancorp.com. We are here to assist you and appreciate your commitment to improving the security of our systems.
Key Points:
Open Communication: Provide clear contact details for inquiries and reports.
Support Available: Offer assistance and clarification as needed.