git.iko.soy/urbit.org
on master help sign in
Merge pull request #155 from urbit/bug-bounties

Update bug bounties content and rename bounty.md to bounties.md

commit527ee266c5af05789f0b4dd3b4112f09d40d527e authorMorgan Sutherland <msutherl@users.noreply.github.com> dateFri 26 Jul 2019, 10:30 (7 years ago) parentb2df38709542a9
3 files changed+8−12
compare with master
unifiedsplit
config.toml+1−1 content/bounties.md+7 content/bounty.md−11
config.toml+1−1
@@ -45,7 +45,7 @@ urbit_footer = [
4545 {url = "$BASE_URL/faq/", name = "FAQ"},
4646 {url = "$BASE_URL/tos/", name = "Terms of Service"},
4747 {url = "$BASE_URL/privacy/", name = "Privacy Policy"},
48− {url = "$BASE_URL/bounty/", name = "Bug Bounties"},
48+ {url = "$BASE_URL/bounties/", name = "Bug Bounties"},
4949]
5050
5151docs_number_chapters = true
content/bounties.mdnew file+7
@@ -0,0 +1,7 @@
1++++
2+title = "Bug Bounties"
3++++
4+
5+We're running a security bug bounty program with [HackerOne](https://hackerone.com). See the [Tlon Corp](https://hackerone.com/tlon/) page for more information. If you've found a vulnerablity, and you'd like to claim a bounty, please submit a report there. Note that our bounty program is currently focused on [Azimuth](https://github.com/urbit/azimuth) vulnerabilities.
6+
7+For general inquiries and disclosures, please contact our security team at [security@tlon.io](mailto:security@tlon.io).
content/bounty.mddeleted−11
@@ -1,11 +0,0 @@
1−+++
2−title = "Bug Bounties"
3−+++
4−
5−We are in the process of designing our Bug Bounty Program. In the meantime, if you believe you have discovered a bug or vulnerability in our code, please report it to [security@tlon.io](mailto:security@tlon.io).
6−
7−We'll review the issue, and a member of our dev team will get back to you ASAP. If your bug has merit, we'll work with you to fix it, and award a bounty based on the severity of the bug. We determine severity using the [CVSS](https://www.first.org/cvss/calculator/3.0) model.
8−
9−Once the fix is complete, we'll publish a full retrospective in the interests of transparency. If the bug leaks prior to the retrospective being published, the bounty is void.
10−
11−We look forward to working with you.