EMBL-EBI Bug Bounty Program

Bug Bounty Scope

The following websites are within the scope of the program:

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

General Requirements:

Keeping the information we hold secure is of the utmost importance to EMBL-EBI. We value any contribution made by those outside the organisation in improving the security of our services. We are committed to working with the community to verify, reproduce, and respond to legitimate reported vulnerabilities. We encourage the community to participate in our responsible reporting process which applies to services relating to the following domains:

- ebi.ac.uk

Testing Requirements:

We will assess all reports and investigate those reports satisfying the following criteria. We will make every effort to correct any vulnerability within 6 months. To encourage responsible reporting, we commit that we (EMBL) will not take legal action against you or ask law enforcement to investigate you if you comply with the following Responsible Disclosure Guidelines:

- Reporter to provide details of the vulnerability, including information needed to reproduce and validate the vulnerability and a Proof of Concept (POC)
- Reporter to give us up to 6 months to correct the issue before making any information public
- Reporter to make a good faith effort to avoid privacy violations, destruction of data and interruption or degradation of our services
- Reporter does not modify or access non-public data, or data that is not theirs
- Reporter to refrain from requesting compensation for reporting vulnerabilities. Upon request we will publicly acknowledge reporter’s responsible disclosure after issues are resolved.
- Reporter to refrain from using automated tools to scan for vulnerabilities, as this can have an adverse effect on other users of our services.

Possible Awards:

Reporter to refrain from requesting compensation for reporting vulnerabilities. Upon request we will publicly acknowledge reporter’s responsible disclosure after issues are resolved.

Special Notes:

We will attempt to respond to your report within 5 working days (we are closed over Christmas and New Year).