⚡ Direct Answer Summary (AI Overview / Key Takeaway)
Guidelines and safe harbor commitments for security researchers reporting vulnerabilities under RFC 9116 security.txt.
eTrepid Coordinated Vulnerability Disclosure Policy (VDP)
Governing Standard: RFC 9116 / NIST SP 800-171 SI.2.216 / CISA Best Practices
1. Overview & Commitment
eTrepid Inc. is dedicated to maintaining the security and integrity of its digital infrastructure, customer-facing portals, and managed security operations. We value the cybersecurity research community and believe that responsible, coordinated disclosure enhances the security of the entire ecosystem.
This Vulnerability Disclosure Policy (VDP) establishes clear guidelines for security researchers conducting authorized testing against eTrepid assets, sets expectations for reporting vulnerabilities, and establishes our commitment to safe harbor protection.
2. Safe Harbor Commitment
If you conduct vulnerability research and make a good-faith effort to comply with this policy during your investigation, eTrepid will consider your research:
Authorized under applicable anti-hacking laws (including the Computer Fraud and Abuse Act, CFAA).
Exempt from legal action by eTrepid regarding claims of copyright circumvention (DMCA).
Lawful and coordinated, and we will not pursue legal action or notify law enforcement regarding your security testing activities.
If a third party initiates legal action against you for activities conducted strictly in accordance with this policy, eTrepid will take reasonable steps to make known that your activities were conducted with our authorization.
3. Guidelines for Authorized Research
To maintain safe harbor status, researchers must adhere to the following rules:
No Disruption: Do not disrupt, degrade, or compromise the availability of eTrepid production environments, services, or customer systems (e.g., DoS/DDoS attacks are strictly prohibited).
No Data Theft or Privacy Violations: Do not view, copy, download, alter, or destroy customer data, employee personal information, or Controlled Unclassified Information (CUI). If you encounter sensitive data during research, stop immediately and report the finding.
No Social Engineering: Do not conduct phishing, vishing, or social engineering attacks against eTrepid employees, contractors, or customers.
No Physical Attacks: Do not attempt physical penetration of eTrepid offices, facilities, or datacenter locations.
No Extortion: Do not demand financial compensation or bug bounties as a condition of disclosing a vulnerability. eTrepid does not operate a paid bug bounty program at this time, but publicly acknowledges valid contributions upon request.
Confidentiality During Remediation: Provide eTrepid a reasonable remediation window (minimum 90 days from receipt) before publicly disclosing vulnerability details.
4. Scope
4.1 In-Scope Systems
The following digital assets owned and operated by eTrepid Inc. are covered by this policy:
`www.etrepid.com` (Corporate Website)
`assurance.etrepid.com` / `trust.etrepid.com` (Assurance Center)
Public-facing APIs directly published and maintained by eTrepid.
4.2 Out-of-Scope Systems
Any third-party SaaS applications, cloud infrastructure providers (AWS, Microsoft Azure), or vendor systems (such as underlying third-party endpoint agents or hardware firmware) not directly managed by eTrepid.
Client customer networks, managed enclaves, and tenant environments monitored by eTrepid. Testing customer infrastructure is strictly illegal and will be reported to law enforcement.
5. How to Report a Vulnerability
Submit vulnerability reports through our designated secure channels:
Designated Intake Portal: Submit directly via the eTrepid Sovereign Trust Center Intake Form (Select Topic: Vulnerability Disclosure Program).
PGP Key & RFC 9116 Manifest: Available at `https://www.etrepid.com/.well-known/security.txt`.
Urgent SOC Escalation Line: Call toll-free 833-eTrepid (833-387-3743).
Report Requirements:
Description: Clear summary of the vulnerability, affected URL/service, and estimated severity.
Reproduction Steps: Step-by-step instructions, proof-of-concept (PoC) code, or non-destructive screenshots.
Contact Information: Researcher name/handle and contact details for follow-up questions and acknowledgment.
6. eTrepid Commitments & Response Timelines
Upon receiving a valid vulnerability disclosure, eTrepid commits to:
Initial Acknowledgment: Within 48 business hours of receipt.
Triage & Validation: Within 5 business days, confirming whether the report is accepted as valid.
Remediation Coordination: Maintain open communication regarding remediation progress.
Public Acknowledgment: Credit the researcher in our Security Wall of Fame (unless anonymity is requested).
