Responsible Disclosure

Preference, Prioritization, and Acceptance Criteria

We will use the criteria from the next sections to prioritize and triage submissions.

• Reports that include only crash dumps or other automated tool output may receive lower priority.
• Reports that include products not on the initial scope list may receive lower priority.
• Please include how you found the bug, the impact, and any potential remediation.
• Please include any plans or intentions for public disclosure.

‍

What You Can Expect from Cubist

• A timely response to your email (within 2 business days).
• After triage, we will send an expected timeline, and commit to being as transparent as possible about the remediation timeline as well as on issues/challenges that may extend it.
• Notification when the vulnerability analysis has completed each stage of our review.
• Credit after the vulnerability has been validated and fixed.

If we are unable to resolve communication issues or other problems, Cubist may bring in a neutral third party to assist in determining how best to handle the vulnerability.