We take security seriously.
Security is our top priority and we proactively look for ways to improve the security of our products. Our security program is transparent so you can be confident when using our products for mission-critical projects.
Report a Vulnerability
We welcome all contributions from our user community, developers, and security researchers to reinforce our product security. You could even be recognized in our security hall of fame for disclosing vulnerabilities responsibly!
We strongly encourage you to report any security vulnerabilities to our private and confidential security mailing list: firstname.lastname@example.org first, before disclosing them in any forums, blogs, sites, social media, or other groups, should they be public or private.
If you wish to send secure messages to email@example.com, you may use the following key:
Responsible Disclosure of Vulnerabilities
Based on the ethics of responsible disclosure, it is recommended to follow the process given below to report security vulnerabilities.
- If you are an independent security researcher or a community user, you must only use the firstname.lastname@example.org mailing list.
- If you are a 42Crunch customer, you can either mail email@example.com or open a ticket at https://support.42crunch.com
- 42Crunch Platform and 42Crunch Firewall
- Open redirect
- Cross-site Request Forgery (CSRF)
- Command/File/URL inclusion
- Code execution
- Cross-Site Scripting (XSS)
- Code or database injections
- Authentication or authorization flaws
- Server-side code execution bugs
- Missing Function Level Access Control
- Insecure Direct Object References
Everything else must NOT be attempted nor reported and do not qualify for rewards
- Account/email enumerations
- Denial of Service (DoS)
- Attacks that could harm the reliability/integrity of our business
- Spam attacks
- Clickjacking on pages without authentication and/or sensitive state changes
- Mixed content warnings
- Lack of DNSSEC, SPF, DKIM, DMARC
- Content spoofing/text injection
- Timing attacks
- Social engineering
- Insecure cookies for non-sensitive cookies or 3rd party cookies
- Vulnerabilities requiring exceedingly unlikely user interaction
- Exploits that require physical access to a user's machine
- Logout Cross-site Request Forgery (CSRF)
- Missing CSRF token in login forms
- Cross domain referer leakage
- Missing HttpOnly flag
- SSL/TLS related issues
- Missing X-Frame-Options or X-Content-Type-Options HTTP headers