BDVDB practices coordinated disclosure. Our aim is to get vulnerabilities fixed and to give the public accurate information, while protecting the people who report them.
Scope
This policy covers vulnerabilities in software, firmware and online services that affect users in Bangladesh, as well as vulnerabilities in the BDVDB website and data. [EDIT: list anything you do not accept.]
Reporting channels
- Preferred: the report form, which encrypts your report in your browser before sending it.
- Encrypted email: send a message to [EDIT: security email address], encrypted with the key on the Security and PGP page.
Please do not report vulnerabilities through public issue trackers or social media. Do not include full exploit code in your first report.
Response timelines
These are targets. We will tell you if a case needs longer.
| Stage | Target |
|---|---|
| Acknowledge your report | [EDIT: 3 business days] |
| Complete initial triage | [EDIT: 10 business days] |
| Contact the vendor | [EDIT: 5 business days after triage] |
| Status updates to you | [EDIT: every 14 days] |
| Default public disclosure | [EDIT: 90 days after vendor contact] |
We may publish sooner if a vulnerability is being actively exploited, or if a fix is already public. We may wait longer if a vendor is making real progress and needs more time. If a vendor does not respond, we will publish after the default period with whatever guidance we can offer.
Safe handling
- Reports are stored encrypted, and only maintainers working on a case can read them.
- We share with the vendor only what it needs to confirm and fix the problem.
- We never share your identity with a vendor without your permission.
- Reports are deleted [EDIT: retention period] after a case closes.
Good-faith research
We ask that you avoid harming people or systems, access no more data than you need to confirm an issue, stop and report if you meet personal data, and do not demand payment in exchange for silence.
BDVDB cannot give legal protection for testing systems owned by others. Vendor programs and the law of Bangladesh still apply. [EDIT: have a lawyer review this section.]
Credit
If you wish, we credit you by public handle on the entry and on the Ranking page. You can stay anonymous, and you can change your mind at any time before publication. BDVDB does not pay bounties. [EDIT: confirm.]