Reporting Security Vulnerabilities

For Progress Customers:

At Progress we work diligently to identify and correct any security issues found in our products. Customers who believe they have identified a security issue or vulnerability in one of our products are advised to contact Technical Support in order to have an engineer evaluate and document a possible security issue for our engineering teams to confirm and remedy when appropriate. Customers wishing to report a suspected security vulnerability should contact Technical Support.

For Security Researchers:

Progress values its partnership with the security researcher community and encourages reports of suspected vulnerabilities in our web sites or products. Security Researchers and Ethical Hackers may submit suspected vulnerabilities via the submission form below, and we will make a best effort to meet the following response times.

Disclosure Policy

• As this is a private program, please do not discuss any vulnerabilities (even resolved ones) without express consent from Progress.
• Please follow Bugcrowd's code of conduct in addition to their disclosure guidelines.

Guidance Around Writing Effective Vulnerability Reports

• Details around discovery methodology
  • Describe how the vulnerability was discovered
    • Tools, techniques, procedures
  • Include specific information around the target
    • Software versions, database types, etc
• Accurate reproduction steps
  • Explicit instructions on how to induce the vulnerability
  • Details around any specific conditions required for the vulnerability to be triggered
• Risk assessment information
  • Details risks associated with the discovered vulnerability
  • Provide context on how the vulnerability could be exploited
• Additional tips for reports
  • Includes screenshots or scripts (if applicable)
  • Be clear and precise with reporting language

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep Progress and our users safe!