ThreatDown Responsible Disclosure Guidelines
Divulgation responsable ou non responsable
D'après notre expérience, (a) la divulgation du code d'exploitation de la preuve de concept, (b) les détails inutiles pour faire passer le message ou (c) la divulgation des détails de la vulnérabilité avant la disponibilité d'un correctif constituent une divulgation irresponsable qui fait plus de mal que de bien, car elle attire inutilement l'attention sur un problème de sécurité. Par conséquent, le programme ThreatDown n'accordera des primes aux personnes qui signalent des bogues que si elles respectent les directives de divulgation responsable.
What do we mean by Responsible Disclosure Program ?
A vulnerability disclosure program (VDP), also known as a responsible disclosure program, offers a structured and responsible channel that researchers can use for submitting accidental security vulnerability findings across our entire ecosystem of applications, infrastructure, services and products.
Reports submitted through ThreatDown’s Responsible Disclose Program are not eligible for monetary awards. However, when applicable, we can request CVEs, and ThreatDown will provide recognition.
What do we mean by Bug Bounty Program?
A bug bounty program engages researchers to look for vulnerabilities within ThreatDowns’s products in scope in exchange for a monetary award.
ThreatDown des primes en espèces pour les bogues les plus intéressants. Le montant attribué pour les bogues intéressants dépend de la gravité et de l'exploitabilité du bogue. Cependant, ThreatDown le droit d'augmenter ce montant au cas par cas.
Quelles obligations de confidentialité dois-je respecter lorsque je soumets une proposition ?
If you send us a submission for our programs, you are agreeing that you will never disclose functioning exploit code (including binaries of that code) for the applicable vulnerability to any other entity, unless ThreatDown makes that code generally publicly available or agrees on the disclosure after resolution or you are required by law to disclose it. This does not prevent you from discussing the vulnerability or showing the effects of the exploit in code.
Quels types de vulnérabilités le programme CVD accepte-t-il ?
Our public bug bounty program accepts vulnerability reports for the targets within the ThreatDown’s program scope. Please follow our program guidelines on the HackerOne platform.
Our responsible disclosure program accepts reports about vulnerabilities from any ThreatDown website, service or product.
Last edited September 15, 2026