Effective date: 13 September 2022
Responsible Disclosure
The safety and security of our customers is an essential priority for Tidal Control, and we are committed to it. Toward this end, Tidal Control has formalised this policy for accepting vulnerability reports in our products. We hope to foster an open partnership with the security community, and we recognize that the work the community does is important in continuing to ensure safety and security for all of our customers.
We have developed this policy to both reflect our corporate values and to uphold our legal responsibility to good-‐faith security researchers that are providing us with their expertise.
This Responsible Disclosure has been created with help of NTIA Safety Working Group’s Vulnerability Disclosure Template Version 1.1.
Scope
This Vulnerability Disclosure Program initially covers the following products:
While Tidal Control develops other products, we ask that all security researchers submit vulnerability reports only for the stated product list. We intend to increase our scope as we develop other products.
Legal Posture
We will not engage in legal action against individuals who submit vulnerability reports to Tidal Control’s Security Team. We openly accept reports for the currently listed products. We agree not to pursue legal action against individuals who:
- Engage in testing of systems/research without harming Tidal Control or its customers.
- Engage in vulnerability testing within the scope of our vulnerability disclosure program.
- Test on products without affecting customers, or receive permission/consent from customers before engaging in vulnerability testing against their devices/software, etc.
- Adhere to the laws of their location and the location of Tidal Control. For example, violating laws that would only result in a claim by Tidal Control (and not a criminal claim) may be acceptable as Tidal Control is authorizing the activity (reverse engineering or circumventing protective measures) to improve its system.
- Refrain from disclosing vulnerability details to the public before a mutually agreed-upon time frame expires.
Terms and Conditions
By submitting information in the scope and context of this Policy ("the Report") to Tidal Control:
- You agree that you are acting in good faith and commit to adhering to the guidelines laid out in this policy.
- You agree that Tidal Control may use the Report to update and/or improve its software; and you grant to Tidal Control a non-exclusive, perpetual, irrevocable, worldwide, royalty-free license, with the right to sublicense to Tidal Control’s licensees and customers, under all relevant intellectual property rights, to use, publish, and disclose the Report in any manner Tidal Control chooses and to display, perform, copy, make, have made, use, sell, and otherwise dispose of Tidal Control’s and its sub licensee’s products or services embodying Report in any manner and via any media Tidal Control chooses, without reference to the source. Tidal Control shall be entitled to use the Report for any purpose without restriction or remuneration of any kind with respect to You and/or Your representatives.
How to Submit a Vulnerability
To submit a vulnerability report to Tidal Control’s Security Team, please send an e-mail to security@tidalcontrol.com
Preference, Prioritization, and Acceptance Criteria
We will use the following criteria to prioritize and triage submissions.
What we would like to see from you:
- Well-written reports in English
- Reports that include proof-of-concept code
- Reports that include more than only crash dumps or other automated tool output
- Reports that include how you found the bug, the impact, and any potential remediation.
What you can expect from us:
- A timely response to your email
- After triage, we will send an expected timeline, and commit to being as transparent as possible about the remediation timeline as well as on issues or challenges that may extend it.
- An open dialog to discuss issues.
- Notification when the vulnerability has been validated and fixed.