Responsible Vulnerability Disclosure Policy

We take the security of our systems seriously and we welcome feedback from security researchers in order to improve the security of our products and services.

We require that all researchers take into account the respect for the law. Vulnerability scanning could not serve as a pretext for attacking a system or any other target. Several actions must be avoided. For example:

• Using social engineering
• Compromising the system and persistently maintaining access to it
• Changing the data accessed by exploiting the vulnerability
• Using malware
• Using the vulnerability in any way beyond proving its existence. To demonstrate that the vulnerability exists, the reporter could use non-intrusive methods. For example, listing a system directory
• Using brute force to gain access to systems
• Sharing vulnerability with third parties
• Performing DoS or DDoS attacks

Keep information about any vulnerabilities you’ve discovered confidential between yourself and Salto Systems until we resolve the issue.

We encourage you to submit any report through our Vulnerability Disclosure Program on Intigriti. Intigriti is a bug bounty platform where ethical hackers can submit their vulnerability findings. Intigriti triages the reports and ensures a transparent and fair process for both the company and the researcher. You can find our vulnerability disclosure program here Salto Vulnerability Disclosure - Bug Bounty Program - Intigriti. If your finding is related to one of the assets in scope for our bug bounty programs we recommend you submit it in those programs instead to ensure a fair rewards process. You can find details on our bug bounty programs in the scope section of our vulnerability disclosure program. 

If you are unable or unwilling to submit a finding through Intigriti please use this contact form