This policy is intended for security researchers who have an interest in reporting security vulnerabilities or even potential security-related issues to the MURAL security team. This also sets our definition of good faith in the context of finding and reporting security vulnerabilities, as well as what you can expect from us in return for your effort, time, good will, and professional behavior.
MURAL’s VDP initially covers the following assets for reporting:
As we move forward on this experience we will add more assets to our scope, so stay tuned!
First Response Time: when you send us the initial submission, we will make our best effort to quickly reply to you. We don't use any type of bot, android or roomba... well, maybe yes, anyway, expect a kind welcome from one of our team members in two workdays or less (we always have something to do 😉).
Triaging Time: we are committed to working with security researchers to help identify and fix vulnerabilities on any of our scoped systems, and we will try to keep you updated about the progress of your report throughout the triage process. Keep in mind that this could take up to 10 workdays from the initial submission day.
Safe Harbor: we can promise that we will NOT take any legal action on participating researchers who act in good faith by following the guidelines outlined in this policy. If you have any doubt about this or any point of this policy, submit your report to us before engaging in conduct (accidental or not) that may be inconsistent with or unaddressed by this policy, or don't hesitate to use one of our communication channels listed in this policy to contact us.
Research Safety: If you come up with some fancy new techniques/vulnerabilities that you want to keep secret, eg.: until you present them at a security conference (this must be aligned with our Disclosure Policy), we can assure you we will keep it secure, confidential and encrypted, so we will not share it with any third party. For obvious reasons, we’ll just only do it with our team members that will be responsible for fixing them during the remediation process with the minimum amount of information as possible.
When researching please try to adhere these guidelines:
Own your data: if you find a vulnerability that gives you access to other user’s data, please exploit it on an account that you own, create a couple of test accounts; check with us first if you think you really, really, really need that.
Pwn → ∞, Destroy → 0: do not incur in any activity that results in denial of service conditions, degradation of our services, spamming, brute forcing accounts, or any other black magic that affects our customer's user experience, privacy, and data.
Hack the planet, but not humans: social engineering is out of scope; do not attempt to socially engineer our organization, contractors, or our users.
Good reports: we expect English, well-written reports. Every vulnerability that you report must be followed by a PoC, attaching code listings, screenshots or any other evidence that you think could help on the triaging process; reports with a clear step-by-step, remediation commendations and impact score that help us understand and save us time reproducing and fixing the vulnerabilities, will be more likely to be accepted. For more information see the Reporting Vulnerabilities section below.
Coordinated Disclosure: if you have any plans to publicly disclose any of the vulnerabilities found in any assets described by our Scope section, please add this will into your report. We encourage you to not do that until:
Bring Your Own Skills: we want to see your skills and how you apply your (lateral) thinking to bypass our protection measures. Try to avoid just copy-pasting the results from automated scans unless that you attach a PoC that demonstrates a specific vulnerability.
Finally, these are a couple of things that you may also try to avoid submitting because they unlikely be eligible for a bounty:
Finally, here are some of the things that you may also try to avoid submitting because they will unlikely be eligible for a bounty:
We encourage you to write high-valuable reports that help us to shorten the triage and remediation process time. For this reasons we recommend you to follow these guidelines:
Report Format: we will only accept reports with markdown format, otherwise, the submission will be rejected. Before submitting your report, try to make sure that these guidelines are met:
Report Template: there’s a couple of fields that we would like to see on every report:
Communication Channel: the only communication channel that we offer to send the reports by this moment is through an email to security-at-mural-dot-co. Every email, as well as the report, evidence, or any attached file, must be encrypted with our PGP key.
All submissions will be rated by us only using the following criteria. We will not accept a rated submission. If that occurs we may re-rate or dismiss that submission.
Critical: these severity issues present a direct and immediate risk to a broad array of our users or to MURAL itself:
High: these severity issues allow an attacker to read or modify highly sensitive data that they are not authorized to access.
Medium: these severity issues allow an attacker to read or modify limited amounts of data that they are not authorized to access.
Low: these severity issues allow an attacker to access extremely limited amounts of data.
If your report has been triaged and validated then we will pay you only via PayPal (we will require your PayPal account). If you do not have a PayPal account we can offer an Amazon gift card instead, for the same amount. Please find our reward program below:
Thank you for keeping MURAL safe and happy hacking!