By participating in this program, you agree:

1. To follow the Intigriti Community Code of Conduct. See “Intigriti Community Code of Conduct.”
2. To follow the Intel Security Vulnerability Researcher Community Code of Conduct. See Security Vulnerability Researcher Community Code of Conduct
3. To follow the Intigriti Terms and Conditions. See “Intigriti Terms and Conditions.”
4. You will not discuss or disclose vulnerability information with anyone not authorized by Intel without prior written consent from Intel (including PoC's on YouTube, Vimeo, etc). See Coordinated Vulnerability Disclosure.
5. You meet the eligibility criteria for this program. See “Security Researcher and Reporter Eligibility Criteria” section.
6. Your submission meets the eligibility requirements for this program. See “Report Eligibility Criteria” and “Product Eligibility Criteria” section.
7. You will not attempt to access anyone else's data or personal information, including by exploiting a vulnerability. See “Sensitive and Personal Information” section.
8. To have freely given Intel a perpetual license for all information and communications provided through the reporting process. See “Intellectual Property” section.
9. You may not participate in this program if you are ordinarily resident in, or located in, any country or region subject to comprehensive sanctions, or if you are an individual or entity identified on any applicable sanctions list (including those administered by OFAC, the EU, the UN, or the UK's OFSI).

By participating in this program, Intel agrees:

1. To provide reasonable safe harbor to researchers following all Rules of Engagement. See “Safe Harbor” section.
2. To provide named acknowledgement on Intel disclosure(s) that include information provided during the reporting process. See “Intellectual Property” section.
3. To use the current CVSS standard for severity scoring. See “Current Standards Used” section.
4. To follow CVE Numbering Authority Rules. See “Current Standards Used” section.

Violating these rules may result in, but is not limited to:

1. Revocation of Report eligibility,
2. Denial of any or all potential rewards,
3. Temporary or permanent revocation of Security Researcher and Reporter eligibility, and
4. Removal from current engagements and/or prohibition from future engagement eligibility.

Researcher/Reporter Agreements

Product Eligibility Criteria

Intel encourages the reporting of all potential vulnerabilities. Intel® branded products and technologies which are maintained and distributed by Intel are eligible for this program. This includes but may not be limited to the following categories.

• Processors
• Server Products
• Wireless
• Ethernet products
• Memory and Storage
• Chipsets
• Graphics
• Cloud Services

Hardware – Product specifications may be found on ARK. Processor support timeline may be found on this help page.
Firmware – Firmware may be found on the Download Center.
Software – Software may be found in a variety of places on the Intel website including Product Support Tools & Utilities, Development Tools, Developer Catalog, and Design-iN Tools Store.
Note: All testing resources must be obtained by participating security researchers.
Note: The Discontinued Products support page can be a useful list for identifying products that are not eligible for this program.

Report Eligibility Criteria

Intel encourages you to submit any report for consideration. For the report to be eligible consideration, your report must meet the following requirements:

1. The report and any accompanying material is first sent to the Intel Program on the Intigriti Portal.
2. The Intel® product(s) in your report correspond to an item in the “Product Eligibility Criteria” section.
3. The vulnerability you identify must be original, not previously reported to Intel, and not publicly disclosed.
4. The report must show that the potential vulnerability has been demonstrated against a currently supported (often the most recent) and publicly available version of the affected product or technology.
5. The report must contain clear documentation that provides information required for the report to be processed.
   1. Minimum:
      1. Name and specific version of the Intel® product(s) the potential issue may impact
      2. How exploiting it may negatively impact confidentiality, availability, and/or integrity of the affected product(s)
      3. Instructions that, if followed by the Intel product engineering team, clearly demonstrate successful exploitation of the reported issue on an impacted Intel® platform
      4. Identify the reported Common Weakness Enumeration (CWE)
   2. Recommended Content:
      1. Overview
         1. An overview/summary of the reported issue
         2. Statement of potential impact
         3. Name and specific version of the Intel® product(s) the potential issue may impact
      2. Details
         1. Detailed explanation of the reported issue
         2. How it can be exploited
         3. How exploiting it may negatively impact confidentiality, availability, and/or integrity of the affected product(s)
         4. Likelihood of a successful exploit
      3. Proof of Concept (POC)
         1. Instructions that, if followed by the Intel product engineering team, clearly demonstrate successful exploitation of the reported issue on an impacted Intel® platform
         2. Information on how any POC code was developed and compiled
         3. Code required to execute the POC
         4. Description of the development environment and operating system revisions
         5. Compiler name, version, options used to compile
      4. Scoring
         1. Proposed CVSS score
         2. Proposed CVSS vector
         3. Justification for the selections (using the stated specification).
         4. Identify the reported Common Weakness Enumeration (CWE)

The more details provided in the initial report, the easier it will be for Intel to evaluate your report. Omitting Proof-of-Concept or Proof-of-Exploit(ability) from a report may result in the report being ineligible or a delay in triage of the report.

Security Researcher and Reporter Eligibility Criteria

All criteria must be met to participate in the Program.

1. You are reporting in your individual capacity or, if you are employed by a company or other entity and are reporting on behalf of your employer, you have your employer’s written approval to submit a report to the Intel® Program.
2. You are at least 18 years of age, and, if considered a minor in your place of residence, you have your parent’s or legal guardian’s permission prior to reporting.
3. You are not a resident of a U.S. (United States) Government embargoed country.
4. You are not on a U.S. Government list of sanctioned individuals.
5. You are not currently, nor have you been an employee of Intel Corporation, or an Intel subsidiary, within 6 months prior to submitting a report.
6. You are not currently, nor have you been under contract to Intel Corporation, or an Intel subsidiary, within 6 months prior to submitting a report.
7. You are neither a family nor household member of any individual who currently or within the past 6 months meets or met the criteria listed in the two bullet points directly above.
8. You agree to participate in testing mitigation effectiveness and coordinating disclosure/release/publication of your finding with Intel.
9. You did not and will not access any personal information that is not your own, including by exploiting the vulnerability.
10. You did not and will not violate any applicable law or regulation, including laws prohibiting unauthorized access to information. To clarify, Intel does not view testing that is done in compliance with the terms and conditions of this Program as unauthorized.
11. There may be additional restrictions on your eligibility to participate in the program depending upon your local laws.

Sensitive and Personal Information

Never attempt to access anyone else's data or personal information, including by exploiting a vulnerability. Such activity is unauthorized. If during your research, testing, or communication with Intel you interacted with or obtained access to data or personal information of others, you must:

• Stop your testing immediately and cease any activity that involves the data or personal information or the vulnerability.
• Do not save, copy, store, transfer, disclose, or otherwise retain the data or personal information.
• Alert Intel immediately and support our investigation and mitigation efforts.

Failure to comply with any of the above will immediately disqualify any report from eligibility.

Intel Agreements

Intel, at its sole discretion, may reject any submission that we determine does not meet the “Security Researcher and Reporter Eligibility Criteria,” “Product Eligibility Criteria,“ or “Report Eligibility Criteria” sections or that are deemed as ineligible as set forth below.

Current Standards in Use

• Common Vulnerability Scoring System (CVSS): Version 4.0
• CVE Numbering Authority Rules: Version 4.1.0

Safe Harbor

If you follow the program terms, we will not initiate a lawsuit or law enforcement investigation against you in response to your report. Please understand that this waiver does not apply to your security research that involves the networks, systems, information, applications, devices, products, or services of another party (which is not Intel). We cannot and do not authorize security research in the name of other entities.

Shared Agreements

Intellectual Property

By submitting your content to Intel (your “Submission”), you agree that Intel may take all steps needed to validate, mitigate, and disclose the vulnerability, and that you grant Intel all rights to your Submission needed to do so.

Intel will, to the best of its ability, offer named acknowledgement on any Intel publications which include information provided through the reporting process. For Submissions with multiple collaborators, please ensure all users are included on the report at the time of submission to ensure acknowledgement.

Acknowledgements will utilize the Intigriti platform username only, unless otherwise requested at the time of submission, or anonymity if requested before publication occurs. Limits may apply. Intel will not edit the acknowledged name unless it can be proven to be inaccurate.

See "Product Eligibility Criteria" and "Report Eligibility Criteria" sections.

End of Life Products

Products which have reached an End of Life (EOL), or End of Service (EOS) status fall out of Scope for bounty rewards, however we request that you report any vulnerabilities to PSIRT for disposition.

Licensed 1st and 3rd Party Products

Intel licensed products, both first- and third-party, are not eligible for rewards of any kind through the Bug Bounty Program. This exclusion only includes components that are specific to the licensed product(s). These are some examples excluded from Scope:

• Intel NUC-specific BIOS and software [Read more]
• Asus NUC hardware

Open-Source Projects

• Open-source projects that are solely maintained by Intel are in Scope of this program.
• Open-source projects which Intel contributes to may fall out of Scope. Please contact the open-source project maintainer directly.
• Always refer to the project-specific Security.md file for details.
• Note: Intel products classified as "free software" may or may not have their source disclosed. 'Open-Source Software' and 'Free Software' are independent designations.

Intel’s Web Infrastructure, i.e.*.intel.com

IT Infrastructure at Intel falls out of Scope. For issues related to Intel's IT infrastructure (services or systems that are not customer-facing), please contact Intel's External Security Research team. Any submissions to the Intel® VDP in this category will be forwarded internally to the appropriate team and closed with a neutral rating to researcher profile statistics wherever possible.

Recent Acquisitions

Recent acquisitions by Intel are out of Scope program for at least 6 months after the acquisition is complete. Products may only be eligible for inclusion if Intel PSIRT supports that product. Other products and companies acquired by Intel which have not yet been branded with Intel trademarks may not be eligible.

Third-Party Products

Third-party products that do or do not contain Intel® branded products or technology fall out of Scope. However, if the issue is root-caused to an Intel® branded product or technology, please submit your report under the appropriate Product type above.

General

Any conduct by a security researcher or reporter that appears to be unlawful, malicious, or criminal in nature will immediately disqualify any submission from the program. Do not engage in extortion. Vulnerabilities in products and technologies that do not meet “Product Eligibility Criteria,” are considered out of Scope.

Credentials

Username, password, account identifier, keys, certificates, or other credentials that have been published, leaked, or exposed in some way should be reported to this program to ensure they can be properly investigated, cleaned up, and secured. Credentials are out of Scope.

Divestitures

Products of former Intel subsidiaries fall out of Scope. Please send vulnerability reports against those products to their respective product security team. This list is not complete but may be used as a guide:

• McAfee - https://www.mcafee.com/us/threat-center/product-security-bulletins.aspx
• Wind River - https://www.windriver.com/psirt-policy
• BlueZ - http://www.bluez.org/development/security-bugs/
• Altera - https://www.altera.com/security/psirt.html

Duplicate Reports

Vulnerabilities already known to Intel fall out of Scope.

Intel Open/Prototyping Platforms

Intel products intended for prototyping use or that are “open” to provide customers with debugging capability are out of Scope.

Owner-Attacker & Physical Access Attacks

Valid submissions against firmware weaknesses requiring physical access or UEFI shell, are out of scope.
Operating System access attacks such as Malicious Kernel are generally considered in scope. Weaknesses found in out-of-band management solutions such as BMC, CSME or similar are generally in scope.

Pre-Release Products

Vulnerabilities in pre-release product versions (e.g., Beta, Release Candidate) fall out of Scope.

Social Engineering

Reports that rely on social engineering to establish the conditions that enable a potential security issue fall out of scope.

This program follows Intigriti's triage standards based on the proof of concept.

Please select one of the sections below and remove the sections that aren't applicable for you

Where can we get credentials for the app?

We currently don’t offer any credentials to test user roles.