Responsible disclosure
Report a vulnerability
If you believe you have found a security vulnerability in a FortiFind product or website, we want to hear about it.
The process
Disclosure in four steps
- 1ReportUse the contact form and choose Security vulnerability disclosure. No exploit code in the first message.
- 2AcknowledgeFortiFind reads every report and replies as soon as it can.
- 3FixValid reports are worked on, and you are kept informed of progress.
- 4DiscloseAfter a reasonable time to fix, the issue can be disclosed publicly, with credit if you want it.
How to report
Use the contact form and choose Security vulnerability disclosure. FortiFind does not yet have a dedicated security email address; one will be published here when it exists.
In your first message, include:
- The product or web address affected, and its version if known.
- A description of the issue and its potential impact.
- The steps needed to reproduce it.
- How you would like to be credited, if at all.
Do not include exploit code, credentials or other sensitive data in a first message. We will arrange a suitable way to share details if they are needed.
Guidelines
- Only test systems you own, or FortiFind systems within the limits below.
- Do not access, change or delete data that does not belong to you.
- Do not degrade service for others: no denial-of-service, spam or social engineering.
- Give FortiFind reasonable time to fix an issue before disclosing it publicly.
What we commit to
- We will read every report and respond as soon as we can.
- We will keep you informed of progress on valid reports.
- We will not pursue action against good-faith research that follows these guidelines.
FortiFind does not currently run a bug bounty program and does not offer payment for reports.