responsible disclosure policy

Responsible Disclosure Policy

Engine Yard Inc. and its subsidiaries (collectively, “Engine Yard”) understand that customers trust us to protect their data. The security of customer data is a significant responsibility that requires the highest priority. To that end, we work diligently to protect our customers from the latest security threats. Engine Yard also welcomes responsible and timely reports of any vulnerabilities discovered on our website or platforms.

Engine Yard will engage with the security community when vulnerabilities are reported to us. We will validate, respond and fix vulnerabilities in accordance with our commitment below. Engine Yard will not initiate legal action against individuals for penetrating or attempting to penetrate our website or platforms, provided they comply with the terms below. Engine Yard reserves all of its legal rights in the event of any noncompliance.

Testing:

• Conduct vulnerability testing only against a “trial” deployment of our online services to minimize risk to our customers’ data
• Refrain from accessing or modifying, or attempting to access or modify, data that does not belong to you
• Refrain from executing, or attempt to execute, a Denial of Service (DoS) attack

Reporting:

• Privately share the details of suspected vulnerabilities with the Engine Yard Security Team by sending an email to security@engineyard.com. Please use our public PGP key to keep your message secure. (ID: '0xC7CC15AB', Fingerprint: '7AF0 04DE C3D5 2205 8C21 48AC 1DF2 16B2 C7CC 15AB')
• Please include information to allow us to efficiently reproduce your steps including:
  • The target's Internet browser flavor and version
  • The steps necessary to reproduce the vulnerability including any specific settings that must be configured on the target to allow the vulnerability to be exploited
  • A copy of the HTML source code following your successful test

Compensation Requests:

• Refrain from requesting compensation for reporting security vulnerabilities

Our Commitment:

To those individuals who follow our “Responsible Disclosure Policy,” Engine Yard commits to:

• Promptly acknowledge receipt of your vulnerability report
• Provide an estimated timetable for resolution of the vulnerability
• Notify you when the vulnerability is fixed
• Publicly acknowledge your responsible disclosure

Thank you!

On behalf of the many customers of our products, we would like to thank the following individuals for having made a responsible disclosure to us: