Cyber Security Policy

Coordinated Vulnerability Disclosure Guidelines

• Avoid unauthorized sharing. During the coordinated disclosure process, please only discuss the vulnerability with the affected vendor, the system owner, and us.
• Give time for a fix. Wait to publicly disclose the vulnerability until the affected parties have had sufficient time to address it, or until you and all parties—including DropBG—have reached a disclosure agreement.
• Keep interactions to a minimum. After you have reported a vulnerability, do not interact with the affected system again during the coordinated disclosure process.
• Limit your scope. When demonstrating a proof of concept, only perform the minimum actions necessary. Do not download, modify, or delete any data beyond what is required.
• Do not exceed your access. Avoid elevating privileges or exploring a system beyond the minimum needed for your proof of concept. Use only your own accounts for testing and never exfiltrate other users' data.
• Use ethical methods. Do not use brute-force or social engineering techniques to gain access to a system.
• Avoid malicious actions. Do not conduct denial-of-service attacks or install malware or viruses.
• Provide IP addresses. Whenever possible, include the IP addresses you used during your discovery. This helps us assess potential exploitation and reduce false positive alerts.
• Communicate your plans. If you intend to publicly disclose your findings, for example, in a talk or article, please let us know ahead of time.