At Black Duck, we take security issues very seriously and recognize the importance of privacy, security, and community outreach. Our mission is to work with third parties (including our customers, the open source community, and others) to improve the security and quality of the software that powers their business functions.
This policy sets forth the reporting and disclosure process that Black Duck follows when we discover security vulnerabilities in third party products and services. If a vulnerability is found in a vendor’s product or service, Black Duck will attempt to contact the vendor by email to notify the vendor of such discovery. Black Duck will initially attempt to create a secure communication channel with the vendor by exchanging PGP keys for encrypted email. If a secure communication channel is successfully created, then an encrypted copy of the vulnerability report will be sent to the vendor through that channel. If no response to the attempt to create a secure communication channel is received by Black Duck within seven (7) days, then a description of the vulnerability will be sent by email to the vendor in plain text.
Our approach to vulnerability disclosure is based on industry standards and the Carnegie Mellon University Computer Emergency Response Team (CERT) vulnerability policy. For additional information, see the CERT disclosure guidelines.
If Black Duck discovers a vulnerability in a vendor’s product or service, it will take the following steps:
Day 0 |
|
Day 7 |
|
Day 45 |
|
Day 60 |
|
Day 90 |
|
In the interest of fostering coordinated vulnerability disclosure, Black Duck will attempt to work with any vendor on reasonable adjustments to the above timeline if progress is being made and the 90-day default timeline is not adequate for creating a patch or other type of mitigation that addresses the vulnerability. Extenuating circumstances may result in adjustments to the disclosures and timelines when reasonably necessary.
If a new or previously undisclosed security vulnerability is found during a Black Duck Consulting Services engagement with a customer, Black Duck will follow the Black Duck Product Security Incident Response Process. Vulnerabilities found in Black Duck products will be handled by the Black Duck PSIRT according to Black Duck's Security Vulnerability Policy.
If the vulnerability is in another vendor’s product, Black Duck will follow the Black Duck Responsible Disclosure Policy unless the affected customer wishes to report the vulnerability to the vendor directly; in that case, Black Duck will facilitate contact between the customer and the vendor, and will notify CERT/CC (or its national equivalent).
Black Duck will protect customer-specific data at all times throughout this process. Specifically, Black Duck will not share any customer-specific data unless directed to do so by the affected customer, or as required by a legal investigation.
Email address: disclosure@blackduck.com