We will:

• Respect the safe harbor clause that you can find below
• Collaborate with you and reply to your submissions as fast as possible

By participating in this program, you agree to:

• Respect the Community Code of Conduct and the Intigriti Terms and Conditions
• Respect the scope of the program
• Not to discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube or other platforms)
• Provide detailed but to-the point reproduction steps
• Include a clear attack scenario. How will this affect us exactly?
• Not to use automatic scanners. Be creative and do it yourself! We cannot accept any submissions found by using automatic scanners and which are not proven to cause a security risk
• Not to obtain, modify, or destroy any information when an identified vulnerability allows you to do so other than to proof the vulnerability
• Not to perform denial of service or load tests

Rewards

Although this is a VDP without rewards, we may provide a small bonus in certain circumstances at our discretion:

• a report is obviously based on a high effort to identify the vulnerability
• a vulnerability is very critical in terms of severity and/or impact to Bühler or our customers
• any other aspect where we think you deserve a reward

We also use the pool of reporters in this VDP as a source for people we potentially invite into our private bug bounty program.

Validation times

We will validate all submissions within the below timelines, once your submission has been verified by Intigriti.

This program follows Intigriti's contextual CVSS standard. We reserve the right to change the severity rating based on our internal assessments of criticality taking into account the criticality of the system or the involved data. We will explain severity rating changes.

Where can I obtain credentials for systems requiring authentication?

At the moment we do not provide credentials for the assets in our VDP scope. You may just focus on black-box testing. However, for systems/services which have a self-service user creation functionality, you may sign-up using your @intigriti.me address.

Why do you exclude so many types of vulnerabilities from the scope?

We already do a lot of automated scanning on all our known (sub)domains. You can assume that most of the "issues" traditional web application security scanners detect are already known to us.