iBet uBet web content aggregator. Adding the entire web to your favor.
iBet uBet web content aggregator. Adding the entire web to your favor.



Link to original content: http://donorbox.org/responsible-disclosure?original_url=https://donorbox.org/?utm_source=Poweredby
Donorbox Responsible Disclosure Policy about Reporting Security Vulnerabilities

Responsible Disclosure Policy

Security is our priority @ Donorbox and we are committed to ensuring the security and privacy of our users. This policy is intended to give clear guidelines on how to responsibly report the security vulnerabilities to Donorbox.

This responsible disclosure policy states that what domains and types of vulnerabilities or findings and research are covered under this policy, how to send us vulnerability findings, and what to expect from our side.

We encourage you to contact us to report potential vulnerabilities in Donorbox.

If you make a good faith effort to comply with this policy after discovering a vulnerability, we would like to know about it so we can take steps to address it as quickly as possible.

If you discover a vulnerability regarding the Donorbox and you want to share it with us, we ask you, in the spirit of responsible disclosure, to send us an email demonstrating vulnerability by following this policy.

Donorbox reserves all legal rights and can initiate a complaint to law enforcement in the event of noncompliance with the policy.

Donorbox will update and revise this policy as we move forward into the future and Donorbox reserves all rights to change or cancel this policy at any time.

  1. How to submit a vulnerability

    1. To disclose a potential security vulnerability, Please email it to our security team:
    2. security@donorbox.org (Encrypt your findings using our PGP key to prevent this critical information from falling into the wrong hands)
    3. When reporting a security vulnerability, please do so responsibly and provide:
    1. a summary of the vulnerability
    2. a proof of concept
    3. tools, commands, or scripts used.

  2. What to expect

    1. We will handle your email with strict confidentiality
    2. We will add your name to our “Hall of fame” if the vulnerability you report is not currently known by us.

  3. In scope asset

    1. donorbox.org

  4. Out of scope targets

    1. Any other domain or sub-domain other than donorbox.org
    2. Donorbox.com
    3. partners.donorbox.com
    4. community.donorbox.com

  5. Typical Vulnerabilities Accepted

    1. OWASP Top 10 vulnerability categories
    2. Other vulnerabilities with demonstrated impact
    3. SQL Injection
    4. Cross-Site Scripting (XSS)
    5. Cross-Site Request Forgery (CSRF)
    6. Authentication related issues
    7. Authorization related issues
    8. Redirection Attacks
    9. Remote Code Execution
    10. Data Exposure

  6. Guidelines

    1. Contact us immediately after you have discovered the security vulnerability.
    2. Only use exploits to the extent necessary to confirm a vulnerability’s presence.
    3. Provide us a reasonable amount of time to resolve the issue and never disclose it publicly.
    4. Once you’ve verified that a vulnerability exists or found any sensitive data you should stop your activity and not move forward and not disclose the finding to any third party.
    5. When investigating vulnerabilities, please act in good faith and respect the data privacy of other users as well as the service availability of Donorbox. Many people use Donorbox daily, and it’s harmful -- and illegal -- to disrupt their usage of Donorbox.
    6. Never request compensation or bounty for finding security vulnerabilities and reporting them to us.
    7. Use your accounts in the process of finding the bug.
    8. If in doubt, contact us.

  7. Prohibited Actions

    1. Do not erase/manipulate data or compromise Donorbox services or get involved with the 3rd parties to share our confidential data.
    2. Never violate the privacy policy of Donorbox users.
    3. Do not get involved in any kind of social engineering, spam, and physical testing.
    4. Do not get involved in phishing
    5. Do not conduct intrusive research, such as DoS attacks, or take any other action that may jeopardize the security, credibility, or availability of data and systems.
    6. Do not publicly disclose it or share your vulnerability finding with anyone else.
    7. No testing of Third-party Services
    8. Do not upload anything related to vulnerability to third parties. i.e. Youtube etc.
    9. Never use a vulnerability to compromise or ex-filtrate files, to gain permanent or persistent command-line access, or to pivot to other applications, systems, or programs.
    10. Do not access, destroy, or negatively impact Donorbox or its customers’ data in any way
    11. Do not break any laws or agreements already made.
    12. Never automated scanner or tools to look for vulnerabilities in Donorbox.
    13. Don't take advantage of the weakness you've discovered.
    14. Data destruction or manipulation is never allowed by us.
    15. Never involve in any sort of privacy breaches and violations
    16. Never involve in the degradation and disruption of our user’s experience and our services.

  8. Out of Scope Reports

    1. Theoretical vulnerabilities
    2. Informational disclosure of non-sensitive data
    3. WordPress Username Enumeration
    4. CSV Injection
    5. PHP Info
    6. Information related to server status etc.
    7. Client-side application/browser autocomplete or saved password/credentials
    8. Error pages etc.
    9. Enumeration of directories, files, or assets, etc.
    10. Findings related to password strength etc.
    11. Login/Logout/Unauthenticated/Low-impact CSRF
    12. Missing Cookie flags
    13. Self-exploitation
    14. Valid bugs or best practice issues that are not directly related to the security posture of the Donorbox
    15. Self-XSS like findings that could not be used to attack other users or organizations.
    16. Anything which involves social engineering.
    17. DDOS or DoS.
    18. SSL issues (i.e. misconfiguration or version)
    19. Misconfigured SPF, DKIM, or DMARC records,
    20. Any other service or libraries not directly hosted or controlled by Donorbox (i.e. 3 rd party stuff).

  9. Disclaimer

    1. Donorbox reserves the right to make final decisions
    2. Once you submit a bug to us or find a vulnerability, you agree to be bound by all the rules mentioned above.

  10. Hall of fame

    1. Donorbox would like to express our gratitude to the following individuals or companies for responsibly disclosing the security flaws to us: