submit bug report:https://www.linode.comLinode Security Bug Bounty Program
Linode has partnered with HackerOne to operate our private bug bounty and disclosure program. We welcome in-scope vulnerability reports. Linode is committed to the security of its infrastructure and customer's data. Linode security posture has been designed to give customers the foundation to build secure systems and applications. At Linode, we take security very seriously to guarantee the security and confidentiality of both our infrastructure and customer data. Our team strives to quickly remediate vulnerabilities. We request that you follow coordinated disclosure guidelines until we confirm that the issue is fixed, tested and deployed. Please do not discuss any vulnerability outside the program without Linode Security Team consent. We understand you may want to blog about your findings, but please get our permission and allow us to remediate the issue first.
Security researchers who submit valid reports through this program may be eligible for monetary awards. If you have not been invited to our program, please use the Contact Security Team button on this page to submit your report.
Disclosure Policy
We kindly request all security researchers to carefully review and adhere to our Responsible Disclosure Policy. It outlines the necessary guidelines and procedures for reporting any discovered vulnerabilities or security issues. By following this policy, we can ensure a smooth and efficient collaboration while maintaining the integrity and security of our systems. Your cooperation is greatly appreciated.
SLA
Linode is dedicated to providing response and transparent communication throughout the process of investigating and addressing security concerns. Upon reaching out to us, you can expect a personalized response within 48 hours, acknowledging the receipt of your reported vulnerability. Additionally, we will keep you informed of the progress regularly, with updates provided by Linode at least every five US working days. Some reports may require up to 60 days to be remediated after the report is acknowledged, depending on the complexity of the underlying issue. Our commitment is to ensure that you are promptly attended to and well-informed throughout the resolution process.
Time to first response (from report submit) - 2 business days
Time to triage (from report submit) - 5 business days
Time to bounty (from triage) - 10 business days
Please note that we do not accept reports for assets owned by our customers. Out-of-Scope Assets:
Category Asset
Linode Customers *.linodeusercontent.com
Linode Customers *.linodeobjects.com
Linode Customers *.nodebalancer.linode.com
Linode Customers *.members.linode.com
If you would like to report a vulnerability or malicious activity in a customer-owned asset, please submit your report to our abuse reporting portal.
Happy hunting!
Policy:
https://www.linode.com/responsible-disclosure-policy/
