Auvik looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe. Our Vulnerability Disclosure Program (VDP) is a public program where security researchers can submit their findings through HackerOne. More information can be found here.
Reporting Process
To report a security vulnerability to Auvik, email us at vulnerability@auvik.com. You will receive an auto-response email notifying you that Auvik uses the HackerOne platform for our vulnerability disclosure program. Click on the ‘Submit Vulnerability Report’ link to report your findings. Create a HackerOne account if you don’t already have one. If you already have a HackerOne account, please login using your existing credentials. Upon signing in, you will now be able to submit your vulnerability report. Please include the following information with your submission.
Issue Summary: Please include a brief summary of the bug in two sentences or less. Replication Steps: We’ll try to reproduce the bug so please tell us exactly what you were doing
When you experienced the issue – the more specific the better!
Supporting Material/References: List any materials such as screenshots, logs, and so on to support your findings.
Expected Outcome: Sometimes it’s not obvious what the issue is, even if we can reproduce it. Please tell us what you were expecting to happen.
Disclosure Policy
- You may not discuss these programs or any vulnerabilities (even invalid and resolved ones) outside of the program without express consent from the organization. If you are interested in sharing any information about your testing methodology related to an Auvik report, you must request permission on your report and you must receive written approval from an Auvik team member.
- You may not perform denial of service attacks or any other attacks that may cause privacy violations, interruption or degradation of any Auvik services, or destruction of data.
- You may not spam any web contact forms regarding vulnerabilities. Please follow the reporting process, as mentioned above, for submitting any vulnerabilities.
- You may not send vulnerability submissions to any Auvik email addresses other than vulnerability@auvik.com. Failure to comply will result in a warning and any instances thereafter will result in your email account being blocked.
- You may not download, modify, or delete any data that does not belong to you.
For more information, click here.