Introduction
AB StoredSafe welcomes security research and responsible reporting that helps improve the security of our products, services, and infrastructure.
If you believe you have discovered a security vulnerability, privacy issue, exposed data, or another security-related issue affecting StoredSafe, we encourage you to report it to us. This policy describes what systems are covered, how vulnerabilities should be reported, what we expect from security researchers, and what you can expect from us in return.
Systems in Scope
This policy applies to digital assets, products, and services owned, operated, or maintained by AB StoredSafe, including:
- StoredSafe-operated services under the
storedsafe.com domain;
- StoredSafe appliances and software products;
- Public APIs and interfaces provided by StoredSafe; and
- Other systems explicitly identified by StoredSafe as being in scope.
Out of Scope
The following are not considered in scope unless explicitly stated otherwise:
- Third-party services, infrastructure, or applications not operated or controlled by AB StoredSafe;
- Customer-operated systems, networks, or StoredSafe installations where you do not have explicit authorization from the owner;
- Social engineering, phishing, physical security attacks, or attempts to compromise StoredSafe personnel;
- Denial-of-service or resource exhaustion testing that may affect availability for other users;
- Automated testing that generates excessive traffic or materially affects production systems; and
- Activities that violate applicable law or intentionally compromise the privacy or security of third parties.
Vulnerabilities discovered or suspected in out-of-scope systems should be reported to the appropriate vendor, system owner, or applicable authority.
Reporting a Vulnerability
Please report security vulnerabilities to:
product-security@storedsafe.com
Where appropriate, we recommend encrypting sensitive reports using our published OpenPGP key. Key discovery information is available through our security.txt and via WKD.
Please include as much relevant information as possible, including:
- A description of the vulnerability and its potential security impact;
- The affected product, service, version, URL, or component;
- Detailed steps required to reproduce the issue;
- Proof-of-concept material, if applicable;
- Any conditions required for successful exploitation;
- Suggested mitigations or fixes, if known; and
- Your preferred contact information.
Please do not send unnecessary personal data, credentials, private customer information, or other sensitive information unrelated to demonstrating the issue.
Our Commitments
When you conduct security research in accordance with this policy and report your findings to us, you can expect AB StoredSafe to:
- Acknowledge your report within three business days whenever reasonably possible;
- Perform an initial assessment and attempt to validate the issue as soon as practical;
- Communicate with you in good faith regarding the status of the report;
- Work to remediate validated vulnerabilities within a reasonable timeframe, taking into account severity, complexity, operational constraints, and customer impact;
- Coordinate public disclosure with you where appropriate; and
- Extend Safe Harbor for vulnerability research performed in accordance with this policy.
Our Expectations
When participating in our vulnerability disclosure process, we ask that you act in good faith and:
- Follow this policy and any other applicable agreements. Where there is a direct conflict between this policy and another StoredSafe policy concerning authorized security research, this policy will prevail for that research;
- Report vulnerabilities promptly after discovery;
- Perform testing only on systems within scope and only to the extent necessary to demonstrate the vulnerability;
- Avoid disrupting services, degrading system availability, destroying or modifying data, or negatively affecting other users;
- Avoid accessing data belonging to other users except where strictly necessary to demonstrate the existence of a vulnerability;
- Immediately stop testing and report the issue if you unintentionally encounter personal data, credentials, customer information, health information, payment data, or other sensitive information;
- Interact only with accounts and data you own or for which you have explicit authorization;
- Do not use a vulnerability to establish persistence, pivot to unrelated systems, exfiltrate unnecessary data, or conduct further exploitation beyond what is necessary to demonstrate the issue;
- Use the official reporting channel for vulnerability-related communication with us; and
- Do not engage in extortion, threats, or demands for payment as a condition for withholding disclosure.
Vulnerability Handling Process
Our normal vulnerability handling process consists of the following phases:
- Report: We receive the vulnerability report and acknowledge receipt.
- Validation: We reproduce and assess the issue, determine its impact, and identify affected products or services.
- Remediation: We develop a fix, mitigation, or workaround as appropriate.
- Verification: Where practical, the reporter may be invited to verify that the issue has been resolved.
- Disclosure: Where appropriate, we coordinate public disclosure with the reporter.
The exact process may vary depending on the severity and nature of the vulnerability.
Coordinated Disclosure
We ask researchers to allow us a reasonable opportunity to investigate and remediate reported vulnerabilities before public disclosure.
As a general guideline, we consider up to 90 days from the initial report to be a reasonable coordination period. This is a guideline rather than an absolute requirement, and the appropriate disclosure date may be shorter or longer depending on the circumstances.
Factors that may affect the disclosure timeline include:
- The severity and exploitability of the vulnerability;
- Evidence of active exploitation;
- The availability of effective mitigations or workarounds;
- The complexity of developing and deploying a fix;
- The need to coordinate fixes with customers, suppliers, or other affected parties; and
- Whether information about the vulnerability has already become public.
We will make reasonable efforts to agree on a disclosure date with the reporter. If a vulnerability is being actively exploited, has already been independently disclosed, or poses an immediate and significant risk, earlier disclosure may be appropriate.
If additional time is required to complete remediation, we may request an extension and will explain the reasons for doing so.
We will make reasonable efforts to coordinate public disclosure with the reporter, including the timing of any publication and, where applicable, CVE assignment. We respect the reporter's ability to publish their own research once an appropriate coordinated disclosure date has been reached.
AB StoredSafe may publish its own security notice, remediation information, or advisory where appropriate to inform affected users or customers.
Safe Harbor
When conducting vulnerability research in accordance with this policy, we consider such research to be:
- Authorized with respect to applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy;
- Authorized with respect to applicable anti-circumvention laws, and we will not bring claims against you solely for circumventing technical controls where doing so was necessary for legitimate security research conducted under this policy;
- Exempt, on a limited basis, from restrictions in our Terms of Service, Acceptable Use Policy, or similar terms that would otherwise prevent legitimate security research conducted in accordance with this policy; and
- Conducted in good faith and intended to improve the security of StoredSafe and its users.
You remain responsible for complying with applicable laws.
If legal action is initiated by a third party against you for research that you conducted in good faith and in accordance with this policy, we will, where appropriate, make it known that we considered your research to have been conducted in compliance with this policy.
Safe Harbor applies only to legal claims under the control of AB StoredSafe and cannot bind independent third parties.
If you are uncertain whether a planned activity is permitted under this policy, please contact product-security@storedsafe.com before proceeding.
Recognition
We appreciate researchers who help us improve the security of StoredSafe. With the reporter's permission, we may acknowledge their contribution in a security advisory or other public communication.
Changes to This Policy
AB StoredSafe may update this policy from time to time. The current version published on the StoredSafe website is the version that applies.