ThreatDown Coordinated Vulnerability Disclosure
Visión general
ThreatDown welcomes and encourages independent researchers to report vulnerabilities in our products to us. It is the objective of this Coordinated Vulnerability Disclosure (CVD) program to work with leading researchers in making our products more secure and help protect our users and services.
The CVD program incentivizes external researchers who work with us responsibly by promoting an open communication channel with our security division, awarding bug bounties and duly crediting the effort from leading researchers.
By submitting a security bug or vulnerability to ThreatDown, you acknowledge that you have read and agreed to the Program Guidelines.
ThreatDown publishes CVEs details to the CVE List.
Reporting a security vulnerability
ThreatDown encourages security researchers to submit vulnerability reports for any ThreatDown website, product or service, in an encrypted format to product-security@threatdown.com. Our PGP key can be found HERE.
The ThreatDown application security team will acknowledge receipt of your report, validate and reproduce the issue together with the product development team. Additional help and collaboration might be requested to the security researcher to go through the reproduction steps and make sure the potential security impact is confirmed.
Please note that starting October 12th, ThreatDown assets will no longer be in scope for the Malwarebytes Bug Bounty Program. We are currently evaluating options to launch a dedicated ThreatDown Bug Bounty program and will share updates as soon as possible.