By participating in this program, you agree to:

• Respect the Community Code of Conduct
• Respect the Intigriti Terms and Conditions
• Respect the scope of the program
• Not discuss or disclose vulnerability information without prior written consent (including PoC's on YouTube and Vimeo)

Our promise to you

• If you need any assistance or have questions related to our products take a look at our support page https://support.saltosystems.com/ or feel free to ask us a question
• We aim to validate all submissions within 5 working days.

Your promise to us

• Make a good faith effort to avoid any privacy violations, data destruction or degradation of our services
• Do not post or discuss vulnerabilities without our consent, remember to upload any evidence such as pictures or recordings in accordance with this
• Include a clear attack scenario, we need to know how an issue will potentially affects us. The clearer the better and we appreciate any mitigation suggestions

Our goal is to secure software, after all our customers trust us to secure their physical environment! We think we've done a pretty good job but we know that no implementation is perfect, we hope that you can help us spot the imperfections.

Please let us know prior to submission if you believe you've identified a vulnerability in a domain or asset belonging to Salto but which is missing from the in scope domains.

Anything related to the following scenarios would be considered extra interesting for us:

• Unauthorised lock openings, or escalating/changing access rights to locks without having the permissions to do so;
• Accessing data belonging to other sites (a site is typically representing a physical building/ lock installation) without permissions to do so;
• Deleting or obfuscating event logs;
• Remote code execution.

Having said that remember that our products are used to secure physical locations like the front door of your home. If you can think of a scenario that would make you very uncomfortable with having one of our products mounted to your front door then that is probably a pretty good angle of attack.

Any subdomain which is part of our bug bounty programs are out of scope for this vulnerability disclosure program, please submit them in our bug bounty programs instead. If you are unsure which program a submission belongs to you can reach us using bugbounty@saltosystems.com.

We require that all researchers take into account the respect for the law. Do not use social engineering or similar to achieve an exploit. Do not access more than is needed to demonstrate your exploit.

Example of out of scope actions:

• Using social engineering
• Compromising the system and persistently maintaining access to it
• Changing the data accessed by exploiting the vulnerability
• Using malware
• Using the vulnerability in any way beyond proving its existence. To demonstrate that the vulnerability exists, the reporter could use non-intrusive methods. For example, listing a system directory
• Using brute force to gain access to systems
• Sharing vulnerability with third parties
• Performing DoS or DDoS attacks

Keep information about any vulnerabilities you’ve discovered confidential between yourself and Salto Systems until we resolve the issue.

This program follows Intigriti's triage standards based on the proof of concept.

Where can I get credentials for your applications?

Please visit our other bug bounty programs to gain access to bug bounty assets. Assets which are not included in our other programs are generally out of scope for researcher invites but you can send an email to bugbounty@saltosystems.com and request access if you believe you've found an exceptional issue.

I believe I've found something which demands urgent attention.

Please send us an email at securityalert@saltosystems.com and include the Intigriti submission ID or details of your finding.