submit bug report: https://www.garmin.com/en-US/legal/security/

Keeping Data Safe at Garmin
Garmin aims to keep its products, apps and websites safe for everyone, and data security is very important to us. To that end, here’s some information about the measures Garmin takes to secure data.

Garmin’s Responsible Disclosure Policy
Data security is a priority at Garmin. If you are a security researcher or Garmin customer and think you’ve found a security issue or vulnerability, we appreciate your help in disclosing it to us in a responsible manner. Please don’t access or modify data without permission, and act in good faith not to degrade the performance of our products, apps and websites.

If you believe you have discovered a vulnerability or have a security incident to report, let us know. Please include a detailed description of the possible vulnerability and an email address where we can reach you in case we need more information.

We appreciate your help in making Garmin products, apps and websites secure. We'd also like to thank all those who have already reported security issues.

REPORT A SECURITY ISSUE
View, Export or Delete Your Data
View the information Garmin maintains about your account, registered devices, mobile apps and more. You can request a copy of it or ask us to delete it.

MANAGE YOUR DATA
Get Help with a Product
Our product experts can help you get back on track with relevant answers and solutions.

VISIT SUPPORT CENTER
Frequently Asked Questions about Garmin Security
What does Garmin do to try to prevent and resolve security issues?
Garmin has dedicated security personnel who are armed with an array of security tools that protect and monitor for threats 24/7. Security personnel work closely with teams throughout Garmin in an effort to keep products, apps and websites safe. Members of the Garmin team are also continually keeping our servers up to date with security patches and operating system updates.

How is my personal data protected?
Garmin uses a variety of safeguards, personnel and processes that form defense in depth barriers to protect your data.. Garmin continuously evaluates our security posture to further enhance the security of your data.

What access do third parties have to my personal data?
Please review our Privacy Statement to read about the ways your personal data may be shared with third parties.

submit bug report: https://firebase.google.com/support

Pick a category

Bugs and Features
File Bug Reports and Feature Requests here.

Accounts & projects
Trouble accessing an account or project

Billing
I have a billing question

Push Notification issues
Firebase Cloud Messaging

Analytics help
Google Analytics for Firebase

Database issues
Cloud Firestore or Realtime Database issues

Information
View the Firebase ToS, FAQ, & other information

Pick a different product
My issue is with a specific Firebase product.

GCP support
I have a GCP support plan.

Report spam, malware, or phishing
I would like to report spam, malware, or phishing

submit bug report: https://www.silverstreet.com/

You create the message
we handle the delivery
Connect with anybody, anytime, anywhere. We offer programmable SMS, AI Messaging, 2FA, and Omnichannel communication platforms for you as tools to boost your business. Integrate with our easy-to-use API and benefit from our 24/7 support and global network coverage.


Twizo Communicate
Customise your campaign with a few clicks.


Twizo Authenticate
Protect your customer data with Two Factors Authentication.


SMS
Send SMS in large quantities through the highest quality routes in a fast, scalable and cost effective way.


Number Lookup
Check the operator before sending to perform a better cost effective campaign.

 
Number Lookup
Mobile Number Portability (MNP) is now a worry of the past.

Protect your service and your customers by preventing fraud and security breaches through the use of Number Lookup.

LEARN MORE
 
Twizo Authenticate
Security Authentication - Quick Integration, Many Solutions.

Twizo makes online security simple through easy integration and a variety of authentication solutions. We serve customers globally allowing them to scale their businesses while we worry about their security.

LEARN MORE
 
Twizo Communicate
Seamlessly navigate through our services.

Our cloud based mobile communicator provides you with access to all of our features to manage your campaign, engage with your customers and track the results of your efforts.

LEARN MORE
 
SMS
A powerful way to communicate with your customers on a global scale.

Our API enables you to send SMS in large quantities through the highest quality routes in a fast, scalable and cost effective way. A powerful tool to communicate with your customers across the globe.

LEARN MORE
 
Number Lookup

submit bug report: https://www.robeco.com/en-int/responsible-disclosure

Working on system security
Every day, specialists at Robeco are busy improving the systems and processes. This helps to protect the details of our clients against misuse and also ensures the continuity of our services. However, this does not mean that our systems are immune to problems. If problems are detected, we would like your help.

What can we expect from one another?
Report any problems about the security of the services Robeco provides via the internet. If you discover a problem or weak spot, then please report it to us as quickly as possible. Examples of vulnerabilities that need reporting are:

cross-site scripting vulnerabilities
SQL-injection vulnerabilities
encryption weaknesses
What do we expect from you?
Ensure that you do not cause any damage while the detected vulnerability is being investigated. Your investigation must not in any event lead to an interruption of services or lead to any details being made public of either the asset manager or its clients.

What do we do with your report?
A team of security experts investigates your report and responds as quickly as possible. We ask you not to make the problem public, but to share it with one of our experts. Give them the time to solve the problem. We will let you know what our assessment of your report is, whether we will provide a solution and when we plan to do that.

Rules of the game
There is a risk that certain actions during an investigation could be punishable. If you act in good faith, carefully and in line with the rules of the game supplied, there is no reason for Robeco to report you. So follow the rules as stated in these responsible disclosure guidelines and do not act disproportionately:

Do not use social engineering to gain access to a system.
Do not place a backdoor in an information system in order to then demonstrate the vulnerability, as this can lead to further damage and involves unnecessary security risks.
Make as little use as possible of a vulnerability. Only perform actions that are essential to establishing the vulnerability.
Do not edit or delete any data from the system and be as cautious as possible when copying data (if one record is enough to demonstrate the problem, then do not proceed further).
Do not introduce any system changes.
Do not try to repeatedly access the system and do not share the access obtained with others.
Do not use any so-called 'brute force' to gain access to systems. After all, that is not really about vulnerability but about repeatedly trying passwords.
How should you submit a report?
If you have detected a vulnerability, then please contact us using the form below.

What does not need to be reported via the disclosure point?
The disclosure point is not intended for:

submitting complaints about services
making fraud reports and/or suspicions of fraud reports from false mail or phishing e- mails
reporting viruses
submitting complaints or questions about the availability of the website

submit bug report: https://www.relaso.com/disclosure/

Vulnerability Reporting Policy
The Relaso.com security team acknowledges the valuable role that independent security researchers play in Internet security. Keeping our customers’ data secure is our number-one priority, and we encourage responsible reporting of any vulnerabilities that may be found in our site or application. Relaso.com is committed to working with the security community to verify and respond to any potential vulnerabilities that are reported to us. Additionally, Relaso.com pledges not to initiate legal action against security researchers for penetrating or attempting to penetrate our systems as long as they adhere to the conditions below.


Testing for security vulnerabilities
Conduct all vulnerability testing against Trial or Developer Edition organizations (instances) of our online services to minimize the risk to our customers’ data.


Reporting a potential security vulnerability
Privately share details of the suspected vulnerability with Relaso.com by sending an email to [email protected]
Provide full details of the suspected vulnerability so the Relaso.com security team may validate and reproduce the issue


Relaso.com does not permit the following types of security research
Causing, or attempting to cause, a Denial of Service (DoS) condition
Accessing, or attempting to access, data or information that does not belong to you
Destroying or corrupting, or attempting to destroy or corrupt, data or information that does not belong to you


The Relaso.com security team commitment
To all security researchers who follow this Relaso.com Vulnerability Reporting Policy, the Relaso.com security team commits to the following:

To respond in a timely manner, acknowledging receipt of your report

To provide an estimated time frame for addressing the vulnerability
To notify the reporting individual when the vulnerability has been fixed


No compensation
Relaso.com does not compensate people for reporting a security vulnerability, and any requests for such compensation will be considered a violation of the conditions above. In such an event, Relaso.com reserves all of its legal rights.

submit bug report: https://panzura.com/

Panzura lets you put your data to work.
HOW IT BENEFITS YOU

Create comprehensive workloads in any public cloud without sacrificing security or egressing data.
Leverage actionable intelligence to increase time-to-value from internal data.
Simplify complex processes using our efficient, highly-secure single platform.
Eliminate duplicated data & locate missing files in seconds.

submit bug report: https://whitehat.olacabs.com/

Bug Bounty Program Information
The Ola Bug Bounty Program ("Program") is designed to encourage security researchers to find security vulnerabilities in Ola's software and to recognize those who help us create a safe and secure product for our customers and partners. The Program is operated and facilitated by ANI Technologies Private Limited and its affiliates (together "Ola").

If you believe you have found a security vulnerability in Ola software, we encourage you to let us know as soon as possible.We will investigate the submission and if found valid, take necessary corrective measures. We may request you for additional information regarding the vulnerability(ies), for which you will cooperate in providing. We request you to review our bug bounty policy as mentioned below along with the reporting guidelines, before you report a security issue. By submitting any information to us, you agree to be bound by these terms and conditions ("T&Cs").

To show our appreciation for the security researchers,we offer a monetary reward/ goodies for all valid security issues based on the severity impact and complexity of the same, the individual will also be given a honourable mention in our Hall of Fame.

The information on this page is intended for security researchers interested in reporting security vulnerabilities to Ola security team. If you are an Ola customer and have concerns regarding non-information security related issues or seeking information about your Ola account / complaints, please reach out to customer support

Reporting security issues
Go to the Report a Vulnerability page to report security issues related to our applications.

Rewards
We offer monetary rewards for security issues which meet the following criteria:

The minimum monetary reward for eligible bugs is 1000 INR. All reward amounts, once communicated by Ola, are non-negotiable.
We may reward only with awesome goodies depending on the severity of the vulnerability.
Apart from monetary benefits, vulnerability reporters who work with us to resolve security bugs in our products will be honored on the Hall of Fame page.
Rewards are decided based on the severity, impact, complexity and the awesomeness of the vulnerability reported and it is at the discretion of Ola Bug Bounty panel.
* All the monetary rewards mentioned on this page are in Indian Rupees (INR).

Responsible disclosure & reporting guidelines
You are bound by utmost confidentiality with Ola. You will not publicly or otherwise disclose any information regarding a bug or security incident without Ola’s prior approval.
Please understand that due to the high number of submissions, it might take some time to triage the submission or to fix the vulnerability reported by you. Therefore, give us a reasonable amount of time to respond to you.
Originality, quality, and content of the report will be considered while triaging the submission, please make sure that the report clearly explains the impact and exploitability of the issue with a detailed proof of concept.
Please make sure that any information like proof of concept videos, scripts etc., should not be uploaded on any 3rd party website and should be directly attached as a reply to the acknowledgement email that you receive from us.
You are obliged to share any extra information if asked for, refusal to do so will result in invalidation of the submission.
You will not access any data/internal resources of Ola as well as the data of our customers without prior approval from the Ola security team.
You must be respectful to our existing applications, and in any case you should not run test-cases which might disrupt our services.
Do not use scanners or automated tools to find vulnerabilities since they’re noisy. Doing so will invalidate your submission and you will be completely banned from the Program.
We also request you not to attempt attacks such as social engineering, phishing etc. These kinds of findings will not be considered as valid ones, and if caught, might result in suspension of your account and appropriate legal action as well.
Responsibility at our end
We will be fast and will try to get back to you as soon as possible.
We will keep you updated as we work to fix the bug you have submitted.
The Hall of Fame will be updated only once the vulnerability has been fixed.
Targets in scope
*.olacabs.com
*.olamoney.com
*.ola.foundation
*.olaelectric.in
*.mission-electric.in
*.ola.institute
Ola Cabs mobile app ( Android | iOS )
Ola Lite mobile app - Lighter version of Ola Cabs app ( Android )
Ola Money mobile app ( Android | iOS )
Ola Operator mobile app ( Android )
Ola Partner mobile app ( Android | iOS)
Out of Scope Targets
All the sandbox and staging environments are out scope.
All external services/software which are not managed or controlled by Ola are considered as out of scope / ineligible for recognition.
Newly acquired company websites/mobile apps are subject to a 12 month blackout period. Issues reported sooner in such websites/mobile apps won't qualify for any reward or recognition.
Eligibility
Prerequisites to qualify for reward or recognition:

Be the first researcher to responsibly disclose the bug. Duplicate submissions are not eligible for any reward or recognition.
Must adhere to our Responsible disclosure & reporting guidelines (as mentioned above).
This program is applicable only for individuals not for organizations.
Verify the fix for the reported vulnerability to confirm that the issue is completely resolved.
In scope vulnerability examples
Report a bug that could compromise the integrity of user data, circumvent the privacy protections of user data or enable access to a restricted/sensitive system within our infrastructure.

Example of such bugs are:

Cross-Site Scripting (XSS)
Sql Injection
XML external entity (XXE) injection
Server Side Template Injection (SSTI)
Server Side Request Forgery (SSRF)
Cross-Site Request Forgery (on sensitive actions)
Broken Authentication / Authorization
Broken Session flaws
Remote Code Execution (RCE)
Privilege Escalation
Business Logical flaws
Payment Related Issues
Misuse/Unauthorized use of our APIs
Open Redirects (which allow stealing secrets/tokens)
Out of scope vulnerabilities
Some of the reported issues, which carry low impact, may not qualify. Although we review them on a case-by-case basis, here are some of the common low-risk issues which typically do not earn any recognition:

Clickjacking
Bugs requiring exceedingly unlikely user interaction (e.g Social engineering)
Spamming (e.g. SMS/Email Bombing)
Any kind of spoofing attacks or any attacks that leads to phishing (e.g. Email spoofing, Capturing login credentials with fake login page)
Denial-of-service attacks or vulnerabilities that leads to DOS/DDOS
Login - Logout cross-site request forgery
Self XSS
Presence of server/software banner or version information
Stack traces and Error messages which do not reveal any sensitive data
Third party API key disclosures without any impact or which are supposed to be open/public.
OPTIONS / TRACE HTTP methods enabled
Missing HTTP Security Headers (e.g. Strict-Transport-Security - HSTS)
Missing Cookie Flags (e.g. HttpOnly, secure etc)
Host Header Injection
Broken Links (e.g. 404 Not Found page)
Known public files or directories disclosure (e.g. robots.txt, css/images etc)
Browser ‘autocomplete’ enabled
HTML / Text Injection
Forced Browsing to non-sensitive information (e.g. help pages)
Certificates/TLS/SSL related issues (e.g. BREACH, POODLE)
DNS issues (e.g. Missing CName, SPF records etc.)
End of Life Browsers / Old Browser versions (e.g. internet explorer 6)
Weak CAPTCHA or CAPTCHA bypass (e.g. using browser addons)
Coupon Misuse
Brute force on forms (e.g. Contact us page)
Brute force on “Login with password” page
Account lockout not enforced
CSV injection
Any kind of vulnerabilities that requires installation of software like web browser add-ons, etc in victim's machine
Rate limit mechanism bypass
Kiosk mode / Screen pinning bypass
Any kind of vulnerabilities that requires physical device access (e.g. USB debugging), root/jailbroken access or third-party app installation in order to exploit the vulnerability
Bypassing root/jailbroken detection
SSL Pinning bypass
Tapjacking
Reporting usage of known-vulnerable software/known CVE’s without proving the exploitability on Ola’s infrastructure by providing a proper proof of concept
Bug which Ola is already aware of or those already classified as ineligible
Terms and Conditions
By participating, you agree to comply with Ola’s Terms and Conditions which are as follows:

You shall abide by all the applicable laws of the land. Ola will not be responsible for any non-adherence to applicable laws on your part.
You shall not engage in any confidentiality or privacy breaches or violations, destruction, removal or amendment of data (personal or otherwise), or interruption or degradation of our services during your participation in this Program. In case of any breach or violation, Ola reserves the right to ban you from the Program and/ or take legal action.
Eligibility for reward or recognition is at the discretion of Ola.
Exploiting or misusing the vulnerability for your own or others' benefit will automatically disqualify the report.
Threatening of any kind will automatically disqualify you from participating in the program.
All the communications with Ola related to this program are to remain fully confidential. Researchers must destroy all artifacts created to document vulnerabilities (POC code, videos, screenshots) after the bug report is closed. Failure to do so shall constitute a material breach of these T&Cs.
Ola reserves the right to discontinue the responsible disclosure program at any time without notice.
You may only investigate, or target vulnerabilities against your own account. Testing should not violate any law, or disrupt or compromise any data or access data that does not belong to you.
Vulnerabilities which Ola determines as accepted risk will not be eligible for any kind of recognition.
Any solutions, recommendation or suggestions, including any intellectual property contained therein, provided by you to Ola under this Program, shall immediately transfer to Ola without any limitations or exceptions, and once communicated to Ola you waive all rights, title, ownership and interest therein. If requested, you shall provide Ola with appropriate documentation to formalise any such transfer or assignment.
Changes to Program Terms
The Program, including its policies, is subject to change or cancellation by Ola at any time, without notice. As such, Ola may amend these Program T&Cs and/or its policies at any time by posting a revised version on our website. By continuing to participate in the bug bounty program after Ola posts any such changes, you implicitly agree to comply with the updated Program terms

Program Termination
In the event you breach any of these T&Cs or any other Program terms that Ola releases, Ola may immediately terminate your participation in the Program and/or take any further legal actions as necessary. In some cases all your previous contributions may also be invalidated.

Legal points
We shall not issue reward or recognition to any individual who does not follow the guidelines of our program and depending upon the action of an individual, we could take strict legal action. Ola does not commit to any compensation other than as outlined in these T&Cs or as communicated to you at the time of your submission. Ola shall not be liable to make any payments or rewards towards you in any other circumstances. Ola shall also not be liable in the event of delayed response to you for any submission.

Testing using Tools
Don't be evil. Practice safe checks. You must not use any automated tools/scripts as those can be disruptive or cause systems to misbehave, doing so will invalidate your submission and you will be completely banned from Ola bug bounty program.

submit bug report: https://mailchimp.com/about/security/

As a company that takes data security and privacy very seriously, we recognize that Mailchimp’s information security practices are important to you. While we don’t like to expose too much detail around our practices (as it can empower the very people we are protecting ourselves against), we have provided some general information below to give you confidence in how we secure the data entrusted to us.



Data Center Security
Mailchimp delivers billions of emails a month for millions of users. We use multiple MTAs, placed in different world-class data centers around the United States.
Our data centers manage physical security 24/7 with biometric scanners and the usual high tech stuff that data centers always brag about.
We have DDOS mitigation in place at all of our data centers.
We have a documented "in case of nuclear attack on a data center" infrastructure continuity plan.


Protection from Data Loss, Corruption
All databases are kept separate and dedicated to preventing corruption and overlap. We have multiple layers of logic that segregate user accounts from each other.
Account data is mirrored and regularly backed up off site.


Application Level Security
Mailchimp account passwords are hashed. Our own staff can't even view them. If you lose your password, it can't be retrieved—it must be reset.
All login pages (from our website and mobile website) pass data via TLS 1.2 or higher.
The entire Mailchimp application is encrypted with TLS 1.2 or higher.
Login pages and logins via the Mailchimp API have brute force protection.
We perform regular external security penetration tests throughout the year using different vendors. The tests involve high-level server penetration tests, in-depth testing for vulnerabilities inside the application, and social engineering drills.


Internal IT Security
Mailchimp offices are secured by keycard access and biometrics, and they are monitored with infrared cameras throughout.
Our office network is heavily segmented and centrally monitored.
We have a dedicated internal security team that constantly monitors our environment for vulnerabilities. They perform penetration testing and social engineering exercises on our environment and our employees. Our security team includes OSCP and CISSP certified members.


Internal Protocol and Education
We continuously train employees on best security practices, including how to identify social engineering, phishing scams, and hackers.
Employees on teams that have access to customer data (such as tech support and our engineers) undergo criminal history and credit background checks prior to employment.
All employees sign a Privacy Safeguard Agreement outlining their responsibility in protecting customer data.
In order to protect our company from a variety of different losses, Mailchimp has established a comprehensive insurance program. Coverage includes, but is not exclusive to: coverage for cyber incidents, data privacy incidents (including regulatory expenses), general error and omission liability coverage, excess cyber liability coverage, property and business interruption coverage, as well as international commercial general liability coverage.


SOC II Compliant PCI DSS Certification
Mailchimp's credit card processing vendor uses security measures to protect your information both during the transaction and after it is complete. Our vendor is certified as compliant with card association security initiatives, including the Visa Cardholder Information Security and Compliance (CISP), MasterCard® Site Data Protection Program (SDP), and Discovery Information Security and Compliance (DISC). We also perform annual SOC II audits.

We provide our SOC II Report upon request. Please click the ‘Request Report’, and include any additional questions you may have.

Request Report



ISO 27001 Certification
The International Organization for Standardization 27001 Standard (ISO 27001) is an information security standard that ensures office sites, development centers, support centers, and data centers are securely managed. These certifications run for 3 years (renewal audits) and have annual touchpoint audits (surveillance audits).

Download ISO certification



Protecting Ourselves Against You
Yes, you heard that correctly. We can secure ourselves like Fort Knox, but if your computer gets compromised and someone gets into your Mailchimp account, that's not good for either of us.

We monitor and will automatically suspend accounts for signs of irregular or suspicious login activity.
Certain changes to your account, such as to your password, will trigger email notifications to the account owner.
We monitor accounts and campaign activity for signs of abuse.
In addition to our scalable algorithms, we employ another layer of human reviewers, who monitor for anomalous account and email activity.
We provide the ability to establish tiered-levels of access within accounts.


Investing in Your Privacy
Our Legal team partners with our developers and engineers to make sure our products and features comply with applicable international spam and privacy laws.
We retain a law firm in the UK to consult on EU privacy issues.
We undergo annual verification with a U.S. based third party-outside compliance reviewer under the Privacy Shield verification program, and we have certified our compliance with the EU-U.S./Swiss-U.S. Privacy Shield Frameworks.
We are members of the ANA, ESPC, OTA, and MAAWG.
Our corporate attorneys and Legal Compliance Manager are active members of the International Association of Privacy Professionals (IAPP) and collectively hold the certifications of CIPP/US, CIPP/G, and CIPP/E.


Responsible disclosure program
Mailchimp is committed to ensuring the security of our services and customer information. As part of this commitment, we encourage security researchers to contact us to report any potential weaknesses identified in any product, system, or asset belonging to Intuit. This program isn’t intended to represent a public bug bounty program and we make no offers of reward or compensation for submitting potential issues. We appreciate your commitment to improving Mailchimp services.

Responsible disclosure guidelines
Security Researchers will disclose potential weaknesses in compliance with the following guidelines:

Do

Share the security issue with us before making it public (e.g., on message boards, mailing lists, or other forums).
Wait until we provide you notification that the vulnerability has been resolved before you disclose it to third parties. We're focused on the security of our customers and our systems, and some vulnerabilities take longer than others to address.
Provide a clear, concise description of the steps needed to reproduce any vulnerability you submit.
Provide the complete details related to the security issue, including proof-of-concept (POC) URL, as well as the details of the system(s) where tests have been conducted.
Don't

Don’t cause harm to Mailchimp, Intuit, its customers, shareholders, partners or employees.
Don’t engage in any act that may cause an outage or stop any of Mailchimp’s services.
Don’t engage in illegal activities or any acts that violate any international laws or regulations, or federal or state laws or regulations.
Don’t store, share, compromise or destroy any Mailchimp data or customer data while conducting research activities. If personally identifiable information (PII) is encountered, you are required to stop and immediately notify Mailchimp.
Don’t conduct fraudulent activity or complete fraudulent financial transactions as part of your research.
Out-of-scope vulnerabilities

The following types of vulnerabilities are out of scope for this program:

Phishing
Social engineering
Physical security assessments
Any form of denial of service (DoS) attack


Submission Guidelines
All potential weaknesses submitted must include enough information to reproduce and validate the issue. Documentation should include a detailed summary of the issue, targets, steps performed, screenshots, tools utilized, and any information that will help Intuit during triage.

By following these guidelines and responsibly disclosing any security weaknesses directly to Intuit, we agree not to pursue legal action against you. Mailchimp reserves its legal rights in the event of noncompliance with program guidelines.

Mailchimp will review and promptly acknowledge any submitted issue within three business days of submission through its web form, found here: Responsible Disclosure Form