From f9d76aae5de21f3669396119d391bac4378c944a Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Tue, 6 May 2025 14:46:42 -0400 Subject: [PATCH 1/2] Update bug-bounty.mdx --- docs/internals/bug-bounty.mdx | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/docs/internals/bug-bounty.mdx b/docs/internals/bug-bounty.mdx index c5bc8b39e..42e62e5d1 100644 --- a/docs/internals/bug-bounty.mdx +++ b/docs/internals/bug-bounty.mdx @@ -58,3 +58,23 @@ We ask that researchers: - Give us a reasonable window to investigate and patch before going public Researchers can also spin up our [self-hosted version of Infisical](/self-hosting/overview) to test for vulnerabilities locally. + +### Program Conduct and Enforcement + +We values professional and collaborative interaction with security researchers. To maintain the integrity of our bug bounty program, we expect all participants to adhere to the following guidelines: + +- Maintain professional communication in all interactions +- Do not threaten public disclosure of vulnerabilities before we've had reasonable time to investigate and address the issue +- Do not attempt to extort or coerce compensation through threats +- Follow the responsible disclosure process outlined in this document +- Do not use automated scanning tools without prior permission + +Violations of these guidelines may result in: + +1. **Warning**: For minor violations, we may issue a warning explaining the violation and requesting compliance with program guidelines. +2. **Temporary Ban**: Repeated minor violations or more serious violations may result in a temporary suspension from the program. +3. **Permanent Ban**: Severe violations such as threats, extortion attempts, or unauthorized public disclosure will result in permanent removal from the Infisical Bug Bounty Program. + +We reserve the right to reject reports, withhold bounties, and remove participants from the program at our discretion for conduct that undermines the collaborative spirit of security research. + +Infisical is committed to working respectfully with security researchers who follow these guidelines, and we strive to recognize and reward valuable contributions that help protect our platform and users. From e695203c052960f510479ba34bbb854490192eb0 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Tue, 6 May 2025 14:49:38 -0400 Subject: [PATCH 2/2] Update docs/internals/bug-bounty.mdx Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> --- docs/internals/bug-bounty.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/internals/bug-bounty.mdx b/docs/internals/bug-bounty.mdx index 42e62e5d1..e45de05bf 100644 --- a/docs/internals/bug-bounty.mdx +++ b/docs/internals/bug-bounty.mdx @@ -61,7 +61,7 @@ Researchers can also spin up our [self-hosted version of Infisical](/self-hostin ### Program Conduct and Enforcement -We values professional and collaborative interaction with security researchers. To maintain the integrity of our bug bounty program, we expect all participants to adhere to the following guidelines: +We value professional and collaborative interaction with security researchers. To maintain the integrity of our bug bounty program, we expect all participants to adhere to the following guidelines: - Maintain professional communication in all interactions - Do not threaten public disclosure of vulnerabilities before we've had reasonable time to investigate and address the issue