• There are no suggestions because the search field is empty.
  • There are no suggestions because the search field is empty.
CONTACT

Vulnerability Disclosure Policy

Introduction

Contegix is committed to ensuring the security of our customers by protecting their information from unauthorized disclosure. This policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us.

This policy describes what systems and types of research are covered under this policy, how to send us vulnerability reports, and how long we ask security researchers to wait before publicly disclosing vulnerabilities.

We want security researchers to feel comfortable reporting vulnerabilities they’ve discovered – as set out in this policy – so we can fix them and keep our customers safe. We have developed this policy to reflect our values and uphold our sense of responsibility to security researchers who share their expertise with us in good faith.

 

Authorization

If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, we will work with you to understand and resolve the issue quickly, and Contegix will not recommend or pursue legal action related to your research.

 

Guidelines

Under this policy, “research” means activities in which you:

  • Notify us as soon as possible after you discover a real or potential security issue.
  • Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
  • Only use exploits to the extent necessary to confirm a vulnerability’s presence. Do not use an exploit to compromise or exfiltrate data, establish command line access and/or persistence, or use the exploit to “pivot” to other systems.
  • Provide us a reasonable amount of time to resolve the issue before you disclose it publicly.
  • You do not intentionally compromise the privacy or safety of Contegix personnel or our customers.
  • You do not intentionally compromise the intellectual property or other commercial or financial interests of any Contegix personnel or entities, or any third parties.

Once you’ve established that a vulnerability exists or encounter any sensitive data (including personally identifiable information, financial information, or proprietary information or trade secrets of any party), you must stop your test, notify us immediately, and not disclose this data to anyone else.

 

Scope

All systems and services associated with Contegix.com are in scope.   Vulnerabilities found in non-federal systems from our vendors fall outside of this policy’s scope and should be reported directly to the vendor according to their disclosure policy (if any). If you aren’t sure whether a system or endpoint is in scope or not, contact security@contegix.com  before starting your research.

Reports of vulnerabilities should be submitted to security@contegix.com. 

If you wish to report a discovered vulnerability in an Atlassian products in use by Contegix, please refer to https://bugcrowd.com/atlassianapps.