| Acknowledgments |
link to page where security researchers are recognized |
yes |
current |
IETF |
RFC 9116 |
| Canonical |
canonical URI for this file |
yes |
current |
IETF |
RFC 9116 |
| Contact |
contact information to use for reporting vulnerabilities |
yes |
current |
IETF |
RFC 9116 |
| CSAF |
Link to a provider-metadata.json resource of the Common Security Advisory Framework (CSAF) |
yes |
current |
OASIS Open |
Common Security Advisory Framework Version 2.0, OASIS Standard |
| Expires |
date and time after which this file is considered stale |
no |
current |
IETF |
RFC 9116 |
| Encryption |
link to a key to be used for encrypted communication |
yes |
current |
IETF |
RFC 9116 |
| Hiring |
link to the vendor's security-related job positions |
yes |
current |
IETF |
RFC 9116 |
| Policy |
link to security policy page |
yes |
current |
IETF |
RFC 9116 |
| Preferred-Languages |
list of preferred languages for security reports |
no |
current |
IETF |
RFC 9116 |
| Bug-Bounty |
A project or company that may financially reward reporters via
a bug bounty program as per section 3.5.5 of [CERT.CVD] can indicate this by adding
the line "Bug-Bounty: True". Adding the line "Bug-Bounty: False" indicates that no
financial reward via a bug bounty program can be offered. |
no |
current |
IETF |
Software Engineering Institute,
"The CERT Guide to Coordinated Vulnerability Disclosure", Carnegie Mellon University, CMU/SEI-2017-SR-022, August 2017 |
