Introduction
At Automox, we deeply value the importance of security research and the significant contributions it makes towards a secure future. With this in mind, we have established our Vulnerability Disclosure Program (VDP) as a secure and transparent avenue for the public to report any vulnerabilities they may uncover in our products or services.
What you can expect from Automox
You can expect the following from Automox when participating in the program:
- We will work with you to validate your findings.
- We will strive to fully triage your report within 3 business days.
- We will strive to remediate valid findings within 120 days.
- We will recognize your findings if you are the first to report a unique and significantly impactful vulnerability through the VDP.
- We will provide you with status updates regarding your report at a frequency based on the severity of your finding:
- High: 30 days
- Medium: 90 days
- Low: 120 days
What Automox requires of you
- Adhere to the rules of engagement.
- Notify us as soon as possible once you discover a real or potential security finding.
- Operate in good faith.
Rules of engagement
- You must provide a working Proof of Concept (POC).
- Use only disclosures@automox.com to submit reports and communicate with Automox regarding your findings.
- Be sure to include all occurrences of the same finding in one report instead of submitting them as multiple reports.
- Do not discuss vulnerabilities outside of the VDP without express consent from Automox.
- Do not intentionally view, store, modify, or destroy data that does not belong to you.
- Do not engage in social engineering or phishing of customers or employees.
- Do not engage in disruptive testing like DoS/DDoS, or anything that has a realistic potential to diminish the quality of Automox's services or disrupt the experience of our customers.
- Do not engage in testing using anything other than test accounts.
- Do not violate any laws or breach the Automox Master Services Agreement to discover vulnerabilities.
- You must adhere to in scope and out of scope systems and services (see below).
Automox acknowledges the value of security research automation tools and does not intend to limit their usage. However, if these tools lead to availability problems, Automox will prevent their usage to ensure uninterrupted operation of our systems and services.
List of Banned Tools
The following tools are explicitly banned from use in our environment. Automox will update this list from time-to-time, so be sure to validate against the current list before using any new tool.
- SQLmap or similar
- ffuzz/wfuzz
- Any tool designed to cause a Denial of Service
Reporting guidelines
Please email disclosures@automox.com to report a vulnerability. By sending an email, you confirm that you meet the requirements of Automox's VDP. Include the following details within your report:
- A description of the finding including all instances, hosts or endpoints where it may be located
- Attack scenario/exploitability, and the security impact of the bug to our applications, customers, systems, or services
- Screenshots or videos that demonstrate the problem.
- Step-by-step instructions on how to reproduce the finding, including any HTTP requests or exploit code.
- If applicable, a log of all activity related to your discovery, including your IP address(es) and timestamped requests to aid us in validation and investigation.
What not to do:
- Do not upload screenshots, videos, or exploit code to a publicly accessible server/repository (first or third party) in preparation of your email.
- Do not zip or archive your files (just attach them directly to the form/email).
- Do not provide low quality reports such as those which only contain automated output.
In-scope Systems and Services
- *.automox.com
Out of scope
The following domains identified here are considered out-of-scope and are not authorized for testing.
- help.automox.com
- community.automox.com
- developer.automox.com
- discover.automox.com
- insiders.automox.com
- listen.automox.com
- msp.automox.com
- partners.automox.com
- security.automox.com
- training.automox.com
- university.automox.com
- Domains registered to Automox but hosted by a third party
Vulnerabilities discovered or suspected in out-of-scope systems should be reported to the appropriate vendor or applicable authority.
Monetary rewards
Automox may offer a monetary reward for findings that identify a vulnerability that presents a significant business impact to our products, systems or services. Eligibility for monetary recognition is determined by calculating the internal severity of a finding against the potential impact to Automox and our customers. Monetary rewards for qualifying findings will range from $100 to $5000. We reserve the right, in our sole discretion, to determine if a vulnerability disclosure qualifies for a monetary reward.
If your report is determined to be valid and significant, the following rules apply:
- You must be the first person to report the finding to us. We will review duplicate findings to see if they provide additional information, but otherwise typically recognize only the first reporter.
- You must be in compliance with this policy.
- You must not reside in a country currently on a United States sanctions list.
- You must report in your individual capacity, and not on behalf of a company or entity.
- You must maintain communication with our team to supply additional information as needed to reproduce and triage the finding.
- You must be 18 years or older and have the ability to receive electronic payments.
- Active and former Automox employees, their family members and their household members are not eligible for participation in this program.
- You may be required to provide additional documentation to receive payment of a reward.
- By participating in this program, you consent to allow Automox to share your contact information with our third party payment processor to receive payment of a reward.
- You are responsible for any applicable income tax on your reward.
- We provide a reward after validation of the finding if eligible.
Safe Harbor
Any activities conducted in a manner consistent with this program will be considered authorized conduct and we will not initiate legal action against you.
