Antenna

Vulnerability Reporting Guidelines

Security Vulnerability Reporting

We take security seriously and appreciate the efforts of security researchers and ethical hackers in helping us maintain a secure platform. If you believe you've discovered a potential security vulnerability, we encourage you to report it to us following these guidelines.

What to Report

  • Security bugs in our software or infrastructure
  • Authentication or authorization flaws
  • Data exposure vulnerabilities
  • Cross-site scripting (XSS) vulnerabilities
  • SQL injection vulnerabilities
  • Other security-related issues that could compromise our systems or users

How to Report

Please send your vulnerability report to: security_team@antenna.dev Include the following information in your report:

  • Detailed description of the vulnerability
  • Steps to reproduce the issue
  • Proof of concept if available
  • Potential impact of the vulnerability
  • Your contact information for follow-up questions

Our CVE Assignment and Disclosure Process

As a CVE Numbering Authority (CNA), we are committed to transparently assigning CVE IDs and publishing CVE Records within the context of our vulnerability disclosure process. When a vulnerability report is submitted and validated, we will follow these steps:

  1. CVE ID Assignment: Upon confirmation of a legitimate vulnerability, we will request and assign a CVE ID through the CVE Program.
  2. Coordination with Stakeholders: We will coordinate with relevant stakeholders, including vendors, affected parties, and the vulnerability reporter, to gather accurate and actionable information.
  3. Remediation Efforts: We will work diligently to remediate the vulnerability. The timeline for a fix will depend on its severity and complexity.
  4. Public Disclosure: In coordination with all relevant stakeholders, and once the vulnerability has been addressed, we will disclose the vulnerability to the public by issuing a CVE Record and a public advisory. This ensures effective sharing of accurate and actionable information, similar to CISA's Coordinated Vulnerability Disclosure (CVD) program.

Response Timeline

We are committed to the following response times:

  • Initial response: Within 24 hours
  • Status update: Every 5 business days
  • Vulnerability fix: Timeline depends on severity and complexity

Responsible Disclosure Policy

We kindly request that you:

  • Do not access or modify user data without explicit permission
  • Do not execute denial of service attacks
  • Do not use automated scanning tools without coordination
  • Do not disclose the vulnerability to others until it has been fixed
  • Provide reasonable time for us to address the issue before public disclosure

Recognition

We value the security research community and will:

  • Acknowledge your contribution after the vulnerability is fixed
  • Provide detailed information about how we fixed the issue

Out of Scope

The following types of bugs are not considered valid for our security bug bounty program:

  • Descriptive error messages
  • Social engineering attacks
  • Self-XSS
  • Reports from automated vulnerability scanners

We will not pursue legal action against security researchers who:

  • Follow our responsible disclosure policy
  • Make a good faith effort to avoid privacy violations, data destruction, and service interruption
  • Do not exploit the security issue for their own gain

Thank you for helping us maintain a secure platform for all our users.