125 lines
6.1 KiB
Markdown
125 lines
6.1 KiB
Markdown
<!-- markdown-link-check-disable -->
|
||
|
||
# Security Policy
|
||
|
||
Parity Technologies is committed to resolving security vulnerabilities in our
|
||
software quickly and carefully. We take the necessary steps to minimize risk,
|
||
provide timely information, and deliver vulnerability fixes and mitigations
|
||
required to address security issues.
|
||
|
||
## Reporting a Vulnerability
|
||
|
||
Security vulnerabilities in Parity software should be reported by email to
|
||
security@parity.io. If you think your report might be eligible for the Parity
|
||
Bug Bounty Program, your email should be sent to bugbounty@parity.io.
|
||
|
||
Your report should include the following:
|
||
|
||
- your name
|
||
- description of the vulnerability
|
||
- attack scenario (if any)
|
||
- components
|
||
- reproduction
|
||
- other details
|
||
|
||
Try to include as much information in your report as you can, including a
|
||
description of the vulnerability, its potential impact, and steps for
|
||
reproducing it. Be sure to use a descriptive subject line.
|
||
|
||
You'll receive a response to your email within two business days indicating
|
||
the next steps in handling your report. We encourage finders to use encrypted
|
||
communication channels to protect the confidentiality of vulnerability reports.
|
||
You can encrypt your report using our public key. This key is [on MIT's key server](https://pgp.mit.edu/pks/lookup?op=get&search=0x5D0F03018D07DE73)
|
||
server and reproduced below.
|
||
|
||
After the initial reply to your report, our team will endeavor to keep you
|
||
informed of the progress being made towards a fix. These updates will be sent
|
||
at least every five business days.
|
||
|
||
Thank you for taking the time to responsibly disclose any vulnerabilities you find.
|
||
|
||
## Responsible Investigation and Reporting
|
||
|
||
Responsible investigation and reporting includes, but isn't limited to, the
|
||
following:
|
||
|
||
- Don't violate the privacy of other users, destroy data, etc.
|
||
- Don’t defraud or harm Parity Technologies Ltd or its users during your
|
||
research; you should make a good faith effort to not interrupt or degrade our
|
||
services.
|
||
- Don't target our physical security measures, or attempt to use social
|
||
engineering, spam, distributed denial of service (DDOS) attacks, etc.
|
||
- Initially report the bug only to us and not to anyone else.
|
||
- Give us a reasonable amount of time to fix the bug before disclosing it to
|
||
anyone else, and give us adequate written warning before disclosing it to
|
||
anyone else.
|
||
- In general, please investigate and report bugs in a way that makes a
|
||
reasonable, good faith effort not to be disruptive or harmful to us or our
|
||
users. Otherwise your actions might be interpreted as an attack rather than
|
||
an effort to be helpful.
|
||
|
||
## Bug Bounty Program
|
||
|
||
Our Bug Bounty Program allows us to recognize and reward members of the Parity
|
||
community for helping us find and address significant bugs, in accordance with
|
||
the terms of the Parity Bug Bounty Program. A detailed description on
|
||
eligibility, rewards, legal information and terms & conditions for contributors
|
||
can be found on [our website](https://paritytech.io/bug-bounty.html).
|
||
|
||
## Plaintext PGP Key
|
||
|
||
```
|
||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||
|
||
mQINBF0vHwQBEADKui4qAo4bzdzRhMm+uhUpYGf8jjjmET3zJ8kKQIpp6JTsV+HJ
|
||
6m1We0QYeMRXoOYH1xVHBf2zNCuHS0nSQdUCQA7SHWsPB05STa2hvlR7fSdQnCCp
|
||
gnLOJWXvvedlRDIAhvqI6cwLdUlXgVSKEwrwmrpiBhh4NxI3qX+LyIa+Ovkchu2S
|
||
d/YCnE4GqojSGRfJYiGwe2N+sF7OfaoKhQuTrtdDExHrMU4cWnTXW2wyxTr4xkj9
|
||
jS2WeLVZWflvkDHT8JD9N6jNxBVEF/Qvjk83zI0kCOzkhek8x+YUgfLq3/rHOYbX
|
||
3pW21ccHYPacHjHWvKE+xRebjeEhJ4KxKHfCVjQcxybwDBqDka1AniZt4CQ7UORf
|
||
MU/ue2oSZ9nNg0uMdb/0AbQPZ04OlMcYPAPWzFL08nVPox9wT9uqlL6JtcOeC90h
|
||
oOeDmfgwmjMmdwWTRgt9qQjcbgXzVvuAzIGbzj1X3MdLspWdHs/d2+US4nji1TkN
|
||
oYIW7vE+xkd3aB+NZunIlm9Rwd/0mSgDg+DaNa5KceOLhq0/qKgcXC/RRU29I8II
|
||
tusRoR/oesGJGYTjh4k6PJkG+nvDPsoQrwYT44bhnniS1xYkxWYXF99JFI7LgMdD
|
||
e1SgKeIDVpvm873k82E6arp5655Wod1XOjaXBggCwFp84eKcEZEN+1qEWwARAQAB
|
||
tClQYXJpdHkgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAcGFyaXR5LmlvPokCVAQT
|
||
AQoAPhYhBJ1LK264+XFW0ZZpqf8IEtSRuWeYBQJdLx8EAhsDBQkDwmcABQsJCAcC
|
||
BhUKCQgLAgQWAgMBAh4BAheAAAoJEP8IEtSRuWeYL84QAI6NwnwS561DWYYRAd4y
|
||
ocGPr3CnwFSt1GjkSkRy3B+tMhzexBg1y7EbLRUefIrO4LwOlywtRk8tTRGgEI4i
|
||
5xRLHbOkeolfgCFSpOj5d8cMKCt5HEIv18hsv6dkrzlSYA5NLX/GRBEh3F/0sGny
|
||
vCXapfxa1cx72sU7631JBK7t2Tf+MfwxdfyFZ9TI9WdtP5AfVjgTkIVkEDFcZPTc
|
||
n3CYXqTYFIBCNUD8LP4iTi3xUt7pTGJQQoFT8l15nJCgzRYQ+tXpoTRlf+/LtXmw
|
||
6iidPV87E06jHdK9666rBouIabAtx7i0/4kwo+bSZ8DiSKRUaehiHGd212HSEmdF
|
||
jxquWE4pEzoUowYznhSIfR+WWIqRBHxEYarP4m98Hi+VXZ7Fw1ytzO8+BAKnLXnj
|
||
2W2+T9qJks5gqVEoaWNnqpvya6JA11QZvZ0w7Om2carDc2ILNm2Xx9J0mRUye8P0
|
||
KxcgqJuKNGFtugebQAsXagkxOKsdKna1PlDlxEfTf6AgI3ST8qSiMAwaaIMB/REF
|
||
VKUapGoslQX4tOCjibI2pzEgE//D8NAaSVu2A9+BUcFERdZRxsI7fydIXNeZ2R46
|
||
N2qfW+DP3YR/14QgdRxDItEavUoE1vByRXwIufKAkVemOZzIoFXKFsDeXwqTVW5i
|
||
6CXu6OddZ3QHDiT9TEbRny4QuQINBF0vKCwBEACnP5J7LEGbpxNBrPvGdxZUo0YA
|
||
U8RgeKDRPxJTvMo27V1IPZGaKRCRq8LBfg/eHhqZhQ7SLJBjBljd8kuT5dHDBTRe
|
||
jE1UIOhmnlSlrEJjAmpVO08irlGpq1o+8mGcvkBsR0poCVjeNeSnwYfRnR+c3GK5
|
||
Er6/JRqfN4mJvnEC9/Pbm6C7ql6YLKxC3yqzF97JL5brbbuozrW7nixY/yAI8619
|
||
VlBIMP7PAUbGcnSQyuV5b/Wr2Sgr6NJclnNSLjh2U9/Du6w/0tDGlMBts8HjRnWJ
|
||
BXbkTdQKCTaqgK68kTKSiN1/x+lynxHC2AavMpH/08Kopg2ZCzJowMKIgcB+4Z/I
|
||
DJKZWHWKumhaZMGXcWgzgcByog9IpamuROEZFJNEUAFf7YIncEckPSif4looiOdS
|
||
VurKZGvYXXaGSsZbGgHxI5CWu7ZxMdLBLvtOcCYmRQrG+g/h+PGU5BT0bNAfNTkm
|
||
V3/n1B/TWbpWRmB3AwT2emQivXHkaubGI0VivhaO43AuI9JWoqiMqFtxbuTeoxwD
|
||
xlu2Dzcp0v+AR4T5cIG9D5/+yiPc25aIY7cIKxuNFHIDL4td5fwSGC7vU6998PIG
|
||
2Y48TGBnw7zpEfDfMayqAeBjX0YU6PTNsvS5O6bP3j4ojTOUYD7Z8QdCvgISDID3
|
||
WMGAdmSwmCRvsQ/OJwARAQABiQI8BBgBCgAmFiEEnUsrbrj5cVbRlmmp/wgS1JG5
|
||
Z5gFAl0vKCwCGwwFCQB2pwAACgkQ/wgS1JG5Z5hdbw//ZqR+JcWm59NUIHjauETJ
|
||
sYDYhcAfa3txTacRn5uPz/TQiTd7wZ82+G8Et0ZnpEHy6eWyBqHpG0hiPhFBzxjY
|
||
nhjHl8jJeyo2mQIVJhzkL58BHBZk8WM2TlaU7VxZ6TYOmP2y3qf6FD6mCcrQ4Fml
|
||
E9f0lyVUoI/5Zs9oF0izRk8vkwaY3UvLM7XEY6nM8GnFG8kaiZMYmx26Zo7Uz31G
|
||
7EGGZFsrVDXfNhSJyz79Gyn+Lx9jOTdoR0sH/THYIIosE83awMGE6jKeuDYTbVWu
|
||
+ZtHQef+pRteki3wvNLJK+kC1y3BtHqDJS9Lqx0s8SCiVozlC+fZfC9hCtU7bXJK
|
||
0UJZ4qjSvj6whzfaNgOZAqJpmwgOnd8W/3YJk1DwUeX98FcU38MR23SOkx2EDdDE
|
||
77Kdu62vTs/tLmOTuyKBvYPaHaYulYjQTxurG+o8vhHtaL87ARvuq+83dj+nO5z3
|
||
5O9vkcVJYWjOEnJe7ZvCTxeLJehpCmHIbyUuDx5P24MWVbyXOxIlxNxTqlub5GlW
|
||
rQF6Qsa/0k9TRk7Htbct6fAA0/VahJS0g096MrTH8AxBXDNE8lIoNeGikVlaxK9Z
|
||
S+aannlWYIJymZ4FygIPPaRlzhAoXBuJd8OaR5giC7dS1xquxKOiQEXTGsLeGFaI
|
||
BZYiIhW7GG4ozvKDqyNm4eg=
|
||
=yKcB
|
||
-----END PGP PUBLIC KEY BLOCK-----
|
||
```
|