Responsible Disclosure and Reporter Acknowledgment Policy

This Responsible Disclosure and Reporter Acknowledgement Policy (“Policy”) explains how ADB works with Reporters to improve our online security.

What to Report to ADB

Security incidents and details of vulnerabilities associated with publicly accessible ADB resources, including websites.

However, all information relating to vulnerabilities that you become aware of through this Policy is considered confidential (“Confidential Information”).

Guidelines

We require that all Reporters:

• Do not access employee personal information or ADB confidential information.
• If you accidentally access any of these, please stop testing and submit the vulnerability.
• Stop testing and report the issue immediately if you gain access to any non-public application or non-public credentials.
• Do not disrupt production systems or destroy data during security testing.
• Perform research only within the scope set out in this Policy.
• Use the email below to report vulnerability information to us.
• Collect only the information necessary to demonstrate the vulnerability.
• Securely delete ADB information that may have been downloaded, cached, or otherwise stored on the systems used to perform the research.

If you fulfill these requirements, ADB will:

• Work with you to understand and attempt to resolve the issue quickly (confirming the report within 5 working days of submission)
• Recognize your contribution to our Security Researcher Hall of Fame, if you are the first to report the issue and we make a code or configuration change based on the issue.

Reporting a vulnerability

If you have discovered something you believe to be an in-scope security vulnerability, you should follow the procedure:

• The findings, including contact details, should be sent to [email protected].
• The findings should be communicated using PGP encrypted messages using the public key (PGP Fingerprint: DEAB 0447 1D10 3A05 9C1C 13F4 4F7E 11A7 0B6C 09FC)) available on this website.
• As much information as possible regarding the finding should be communicated to ADB to enable it to reproduce and verify the vulnerability, in order to implement appropriate remediation actions.
• The vulnerability findings must remain confidential until public disclosure of the vulnerability has been made by ADB on this website.

If more information is required regarding a reported vulnerability, ADB may contact the Reporter; therefore, it is important to provide valid contact details, including email address and/or telephone number.

If the conditions listed above are satisfied, ADB will verify the existence of the vulnerability, notify affected parties, and implement actions to mitigate the vulnerability.

Once the vulnerability has been removed, the Reporter will be acknowledged unless he/she wishes to remain anonymous, and listed (at his or her own discretion) on this page with a short description of the vulnerability reported.

By reporting vulnerability findings to ADB, the Reporter acknowledges that such reporting is provided pro bono and without expectation of financial or other compensation, subject to this Policy. 

ADB reserves the right to accept or reject any security vulnerability disclosure report at its discretion.

For any questions about responsible disclosure of results for a submission, please contact us.