submit bug report: https://www.robeco.com/en/responsible-disclosure.html

Working on system security
Every day, specialists at Robeco are busy improving the systems and processes. This helps to protect the details of our clients against misuse and also ensures the continuity of our services. However, this does not mean that our systems are immune to problems. If problems are detected, we would like your help.

What can we expect from one another?
Report any problems about the security of the services Robeco provides via the internet. If you discover a problem or weak spot, then please report it to us as quickly as possible. Examples of vulnerabilities that need reporting are:

cross-site scripting vulnerabilities
SQL-injection vulnerabilities
encryption weaknesses
What do we expect from you?
Ensure that you do not cause any damage while the detected vulnerability is being investigated. Your investigation must not in any event lead to an interruption of services or lead to any details being made public of either the asset manager or its clients.

What do we do with your report?
A team of security experts investigates your report and responds as quickly as possible. We ask you not to make the problem public, but to share it with one of our experts. Give them the time to solve the problem. We will let you know what our assessment of your report is, whether we will provide a solution and when we plan to do that.

Rules of the game
There is a risk that certain actions during an investigation could be punishable. If you act in good faith, carefully and in line with the rules of the game supplied, there is no reason for Robeco to report you. So follow the rules as stated in these responsible disclosure guidelines and do not act disproportionately:

Do not use social engineering to gain access to a system.
Do not place a backdoor in an information system in order to then demonstrate the vulnerability, as this can lead to further damage and involves unnecessary security risks.
Make as little use as possible of a vulnerability. Only perform actions that are essential to establishing the vulnerability.
Do not edit or delete any data from the system and be as cautious as possible when copying data (if one record is enough to demonstrate the problem, then do not proceed further).
Do not introduce any system changes.
Do not try to repeatedly access the system and do not share the access obtained with others.
Do not use any so-called 'brute force' to gain access to systems. After all, that is not really about vulnerability but about repeatedly trying passwords.
How should you submit a report?
If you have detected a vulnerability, then please contact us using the form below.

What does not need to be reported via the disclosure point?
The disclosure point is not intended for:

submitting complaints about services
making fraud reports and/or suspicions of fraud reports from false mail or phishing e- mails
reporting viruses
submitting complaints or questions about the availability of the website

submit bug report: desk.com/help-center-closed/?utm_source=helpcenter-closed&utm_medium=poweredbyzendesk&utm_campaign=text&utm_content=onfo.zendesk.com


Champions of customer service
OUR PRODUCTS
Zendesk for service
Zendesk for sales
Sunshine Platform
Marketplace
Product updates
TOP FEATURES
Ticketing system
Messaging & live chat
Help center
Voice
Community forums
Reporting & analytics
Answer Bot
Customer service software
Ticketing system software
Live chat software
Knowledge base
Forum software
Help desk software
Workforce management
RESOURCES
Security
Product support
Request a demo
Blog
Training
Partners
Webinars
Customer Stories
Services
COMPANY
About us
Newsroom
Investors
Events
Careers
Diversity & Inclusion
Accessibility Plan
Sustainability
Contact us
Sitemap
System status
Zendesk Foundation
Legal
FAVORITE THINGS
What is Zendesk
Zendesk for Enterprise
Zendesk for Small Business
Zendesk for Startups
Zendesk Benchmark
Gartner CRM Magic Quadrant
Customer Experience Trends
What is CRM?
CRM software guide
Join our research panel

submit bug report: https://nextcloud.com

We're inviting researchers all over the globe to take a look at Nextcloud and bring it's security to the next level. If you're interested in learning how we handle security you can read more about it on our dedicated security page.
Program policy
We know how valuable your time is and employ a "No bullshit policy" that boils down to: Don't be a jerk. Instead of bothering you with a huge list of exclusions we're going to tell you what we're especially looking after:
Bugs within Nextcloud server and apps supported by Nextcloud GmbH (Note: see scope below for all qualifying and packaged components. Third-party apps from the AppStore are not part of our bounty program.)
Bugs within the mobile iOS and Android sync clients
Bugs within the desktop sync clients for Mac, Windows, and Linux
A bug is for us something that actively allows an attacker to escalate their privileges. Something like "Attacker can delete arbitrary files of other users" is fine, "Missing X-Frame-Options on the download servers" not so much. At the moment we are also considering Denial of Service not a reward worthy vulnerability. (we will acknowledge you though!)
Found a security bug in one of the above-mentioned components? Awesome! Just report it here and we will get back to you. These components are also for what monetary rewards are awarded. Bonus points if you check back with our threat model before.
Found a bug in one of our websites or so? While we can't offer you any monetary reward we will acknowledge the issue and happily accept reports for it via this platform as well. But please do not run any Denial of Service attacks against our infrastructure or extract user data. Please do also refrain from using automated testing tools against our infrastructure or disclosing bugs to other parties before we have published a patch.
We believe in transparency about our security, so any valid vulnerabilities discovered are always publicly disclosed after a grace period.
Rewards
Our rewards are based on severity and range up to $10,000. To give you some guidance we have compiled below list:
Impact   Definition   Highest possible reward
Critical   Gaining remote code execution on the server as a non-admin user. (i.e. RCE)   $10,000
High   Gaining access to complete user data of any other user. (i.e. Auth Bypass)   $4,000
Medium   Limited disclosure of user data or attacks granting access to a single users' user session. (i.e. XSS with CSP bypass)   $1,500
Low   Very limited disclosure of user data or attacks involving a very high unlikely amount of user interaction.   $500
Last updated on August 3, 2021.
View changes
Looking for what's in scope? Check out the new Scope tab above.

submit bug report: https://www.myob.com/au/legal/report-security-vulnerability


Belkin International places a high value on security of its networking products. For many people, their home Wi-Fi router is the only barrier between their home network and a multitude of hostile internet threats intent on taking over their devices.



To protect our user’s privacy and security, Belkin is happy to accept all vulnerability reports that adhere to our coordinated vulnerability disclosure guidelines.

IN SCOPE
Belkin routers, range extenders, keyboards, and other networked devices
Linksys routers, range extenders, Wi-Fi dongles, switches, and other networked devices
WeMo home automation switches, light bulbs, cameras, and other networked devices
NOT IN SCOPE
Any services or systems that are hosted by third party providers or Belkin International owned property, services be it physical or intellectual. This includes and is may not only limited to:



Belkin.com, Linksys.com, and WeMo.com web endpoints
WeMo Cloud
Linksys Smart Wi-Fi web and cloud endpoints
Social Engineering and Phishing attacks against Belkin employees, contractors, customers, or support

submit bug report: https://www.lego.com/en-nl/legal/notices-and-policies/responsible-disclosure-policy/?locale=en-nl


Responsible Disclosure Policy
If you believe you have found a security vulnerability in a LEGO® product, please tell us about it.

If you are looking to report a non-security related issue, please use the links below for assistance.

– LEGO® Account. Self-service on https://identity.LEGO.com
– Shop@home, VIP and other problems https://www.LEGO.com/service
– Consumer Service https://www.LEGO.com/service
– Privacy Issues. Contact our privacy officer as described on https://www.LEGO.com/legal/legal-notice/privacy-policy

How to report a security vulnerability to us
If you believe you have found a security vulnerability in one of our web sites or apps, we encourage you to let us know right away. We welcome reports from everyone, including developers, researchers and customers.
To report a security vulnerability, please contact us here and include the following information:

– A URL or an IP address, where you found the issue. When did you find it.
– A description of the issue, including what you saw and what you expected to see.

– A list of steps to reproduce the issue, or a video demonstration if it’s a complicated issue.

How the LEGO Group handles vulnerability disclosure
The LEGO Group will send you an automatic reply to let you know that we received your report, and we’ll contact you if we need more information.

Please note that we do not offer a bug bounty program. This means that the LEGO Group does not pay rewards for disclosed security vulnerabilities.

To protect our customers, we investigate all reported issues, but we do not confirm them publicly.

What we ask of you
• You make a good faith effort to avoid any legal and privacy violations, disruptions to others, including (but not limited to) destruction of data and interruption or degradation of our services.
• You do not exploit a security issue you discover for any reason. (This includes demonstrating additional risk, such as attempted compromise of sensitive company data or probing for additional issues.)
• You do not violate any other applicable laws or regulations.