Maintaining the security of our software is a high priority at Coviant Software. If you are a security researcher and have information about a vulnerability in a Coviant Software website, product or application, we want to hear from you. Information submitted to Coviant Software under this policy will be used for defensive purposes – to mitigate or remediate vulnerabilities in our systems or applications.

Coviant Software will deal in good faith with researchers who discover and submit vulnerabilities or indicators of vulnerabilities in accordance with these guidelines.

• Your activities are limited exclusively to –
  1. Scanning to detect a vulnerability or identify an indicator related to a vulnerability; or
  2. Sharing with, or receiving from, Coviant Software information about a vulnerability or an indicator related to a vulnerability.
• You do no harm and do not exploit any vulnerability beyond the minimal amount of verification required to prove that a vulnerability exists or to identify an indicator related to a vulnerability.
• You avoid intentionally accessing the content of any communications, data, or information transiting or stored on Coviant Software information system(s).
• You do not exfiltrate any data under any circumstances.
• You do not intentionally compromise the privacy or safety of Coviant Software, or any third parties.
• You do not intentionally compromise the intellectual property or other commercial or financial interests of any Coviant Software personnel or entities, or any third parties.
• You do not publicly disclose any details of the vulnerability, indicator of vulnerability, or the content of information rendered available by a vulnerability.
• You do not conduct denial of service testing.
• You do not conduct social engineering, including spear phishing, of Coviant Software personnel or contractors.
• You do not submit a high-volume of low-quality findings.
• If at any point you are uncertain whether to continue your research, please engage with our team.
• Do not engage in any activity that violates (a) federal or state laws or regulations or (b) the laws or regulations of any country where (i) Coviant Software data, assets or systems reside, (ii) Coviant Software data traffic is routed or (iii) the researcher is conducting research activity.
• Do not store, share, compromise or destroy Coviant Software or customer data. If Personally Identifiable Information (PII) is encountered, you should immediately halt your activity and contact Coviant Software.
• Do not initiate a fraudulent financial transaction.
• Submissions will be ignored if:
  • Attacks are based on “social engineering” by employees or dealers
  • Phishing attempts are used.
  • Common vulnerabilities found by an automated scanner.
  • CSP vulnerabilities; SSL/TLS best practices
  • Denial-of-service attacks on servers and websites
  • Non-reproducible vulnerabilities
  • Resource Exhaustion Attacks
  • Clickjacking on pages with no sensitive actions

Please note that this should not be construed as encouragement or permission to perform any of the following activities:

• Hack, penetrate, or otherwise attempt to gain unauthorized access to Coviant Software applications, systems, or data in violation of applicable law;
• Download, copy, disclose or use any proprietary or confidential Coviant Software data, including customer data; and
• Adversely impact Coviant Software or the operation of Coviant Software applications or systems.

Coviant Software reserves all rights or claims with respect to such activities.

This program does not allow disclosure. You may not release information about vulnerabilities found in this program to the public.

• Within three business days, we will acknowledge receipt of your report.
• Coviant Software’ security team will investigate the report and may contact you for further information.
• To the best of our ability, we will confirm the existence of the vulnerability to the researcher and keep the researcher informed, as appropriate, as remediation of the vulnerability is underway with the highest priority.

You must comply with all applicable Federal, State, and local laws in connection with your security research activities or other participation in this vulnerability disclosure program.

Coviant Software does not authorize, permit, or otherwise allow (expressly or impliedly) any person, including any individual, group of individuals, consortium, partnership, or any other business or legal entity to engage in any security research or vulnerability or threat disclosure activity that is inconsistent with this policy or the law. If you engage in any activities that are inconsistent with this policy or the law, you may be subject to criminal and/or civil liabilities.

To the extent that any security research or vulnerability disclosure activity involves the networks, systems, information, applications, products, or services of a non-Coviant Software entity (e.g., other Federal departments or agencies; State, local, or tribal governments; private sector companies or persons; employees or personnel of any such entities; or any other such third party), that non-Coviant Software third party may independently determine whether to pursue legal action or remedies related to such activities.

Coviant Software may modify the terms of this policy or terminate the policy at any time.

If you believe you have found a vulnerability in a Coviant Software website, product or application, please submit the vulnerability information to Coviant Software via the form below.

• Please provide a detailed summary of the vulnerability including type of issue, how it was discovered, product, version, location and configuration of software containing the bug.
• Step-by-step instructions to reproduce the issue or proof of concept.
• Possible impact.
• Suggested mitigation or remediation.

Upon submission, we will reach out to you for additional details which will be communicated through email and/or phone.