Vulnerability Disclosure Program

Guidelines for Responsible Disclosure

To maintain a constructive environment for security research, we ask that you follow these guidelines when conducting research:

• Do not engage in any form of Denial of Service (DoS) attacks against byrd applications, servers, networks, or infrastructure.
• Avoid tests that may result in degradation or interruption of our services.
• If using automated scanners or tools, ensure they operate in a manner that does not generate excessive network traffic (e.g., limit requests to a maximum of one per second).
• Refrain from leaking, altering, or deleting any user data or files within our applications or servers.
• Do not access or disclose any files from our applications or servers.
• We do not permit any form of vulnerability disclosure, whether full, partial, or otherwise.
• Avoid submitting spam through registration forms on our websites, including the Support Portal.
• Use the user-agent "VDP name-at-email-dot-com" in all web-based requests.

Guidance

Security researchers must:

• Only access the minimum amount of data necessary. For example, 2 or 3 records should suffice to demonstrate most vulnerabilities, such as an enumeration or direct object reference vulnerability.
• Avoid using high-intensity invasive or destructive technical security scanning tools to discover vulnerabilities.
• Respect the privacy of byrd users, staff, contractors, services, or systems. For instance, do not share, redistribute, or fail to properly secure data obtained from our systems or services.
• Not communicate any vulnerabilities or associated details through methods not outlined in this policy.
• Refrain from altering data in byrd systems or services.
• Do not disrupt byrd services or systems.
• Avoid engaging in social engineering, 'phishing' attacks, or physical attacks against byrd staff or infrastructure.
• Not disclose any vulnerabilities in byrd systems or services to third parties or the public before byrd has confirmed that these vulnerabilities have been addressed or corrected. This does not prevent you from notifying a vulnerability to third parties for whom the vulnerability is directly relevant, such as when the vulnerability is in a third-party software library or framework. However, do not reference specific details of the vulnerability as it applies to byrd in such reports.
• Not demand financial compensation for disclosing any vulnerabilities.
• Securely delete all data retrieved during the research as soon as it is no longer needed or within 1 month of the vulnerability being resolved, whichever comes first.