Do you have a Responsible Disclosure Policy?
So there you are, running your SaaS company and, uninvited and unprovoked, some folks are trying to poke holes into your code, but they do mean well and report anything interesting they found to you (bugs, security issues, etc.): independent security researchers.
Do you have a defined response for handling these researchers and their reports aka a responsible Disclosure Policy or similar?
How do you manage independent security researchers and their work?
We have written policy for this and also pay money for reported issues that we consider actual note-worthy bugs.
Any tips or recommendations or experiences for how to best handle external people reporting issues?
We've published a vulnerability disclosure policy on our website and an email alias for people to send information to.
https://kinde.com/docs/looking-after-you/vulnerability-disclosure-policy
This was based on a template from https://disclose.io/
We've also setup a DNS TXT record based on https://dnssecuritytxt.org/
Defined response - Yes. There's a short internal wiki page describing that the incoming emails have a group inbox, suggestions on generic responses, who to talk to internally for advice, and a severity matrix based on Bugcrowd's taxonomy since it's easy to understand https://bugcrowd.com/vulnerability-rating-taxonomy.
Manage - We've had 5 people send through relevant vulnerabilities. 3 asking for money to reveal and the other 2 were upfront about their findings, one of which we paid for since it was such a high severity. I referred all of them back to our website's policy and made clear that we don't pay (with that one exception) and thanked them for reaching out. We kept the dialogue open until a fix was done or let them know that we will prioritise it another day. No point keeping them on the hook any longer than necessary since they'll likely want to spend more time chasing down paid bounties. So far the experiences have been positive and professional on all sides. That one exception to pay was agreed on by the entire management team since it was such a high severity finding.
I found that it's best to be polite, concise, and honest. They've already put in the work to find the vulnerability. Since we're such a young company and still striving for revenue, we've opted not to pay for submissions. All of them have asked for a reward at some point in the discussion and our response was to re-iterate that we really appreciate the submission and refer them back to the policy.
It can be hard saying no to someone when they've asked for a reward on work that they've done for you. But that's what the publicly facing policy is for. The rules are in there and it's what both parties should base conversations on. We want to mature the policy as our product matures. So in the near future, we'll have a way to publicly thank submission via Twitter or something. And then hopefully we'll be at a point where we can subscribe to a bug bounty program like BC or H1.
Thank you for this long & detailed response!
Your process sounds very much best practice to me (or what I think it should be). Interesting that you had people asking for money before they submit anything. Didn't have such a case so far.
Our policy is a lot shorter (https://www.daito.io/security/) but I hope to extend it with info from the feedback I can collect here. Yours helps a lot to get to v2 of our policy.
Our experience so far has been rather positive: amateurs (usually young people with free time) use some sort of playbook to check our SaaS and send us a report afterwards (sometimes even with screenrecordings or logs), asking for a little thank you gift in return. The majority of reported issues are UX-related or at best a UI nuisance or otherweise low risk (i.e., can not be used to access customer or other data). We don't pay for those.
We paid 100€ per issue so far, but only for the very few issues that we deemed to be higher risk or so relevant that we should fix them asap. The goal is to incentivize people to dig further, obviously, before the bad guys do it.
I'll submit us to the https://disclose.io/programs/ database so that we maybe can get more people to check us out.
I like that your policy is short and gets the point. This was the first time I've had to write one on my own, so I ended up just leaning on what looked like the most fool proof template. Their template does read a lot like bug bounty program briefs.
Only one of the submissions gave us more information about them. They were a university student studying cyber security and pen testing. So sounds like they were looking for VDPs and then taking a crack, which is really good to hear since that means they're making the effort to only test companies that are willing to be tested.
I might suggest to our team to have a reward notice on our page for only critical vulns with a set amount. That might at least get some more interest.
Have you done a penetration test on your application?
Something wish would happen is for larger companies to sponsor bug bounties for startups or founders. Maybe a lottery program where they would gift a certain amount of money to 5 winners each year to startups that meet some minimum criteria.
We did not commission this yet, but had a few people from my network "check it out". We spent and still spend a lot of time on security so getting an external (paid) pentest including a nice report and seal to put on the websit is on the list. Surprisingly not one customer has yet asked for this.