With a new Security page, a dedicated security contact, and a standardized security.txt, ForgeOne is establishing a clear reporting channel for potential security vulnerabilities.
IT security is not just about implementing technical safeguards. Equally important is having a clearly defined process in place for when someone discovers a potential vulnerability.
That is why we at ForgeOne have established a dedicated reporting channel for security vulnerabilities. Security researchers, customers, partners, and other individuals can report potential vulnerabilities to us via our dedicated security contact.
Responsibly Reporting Security Vulnerabilities
On our Security page, we describe how potential security vulnerabilities can be reported to ForgeOne and what information helps us with the technical analysis.
Where possible, a report should include:
- the affected system or URL
- a description of the potential vulnerability
- reproducible steps
- an assessment of the potential impact
- additional technical information, if helpful
Responsible Disclosure
Investigations should be conducted in a way that does not unnecessarily impact systems, data, or users. Details of a potential vulnerability should not be published before we have had the opportunity to review the report and implement appropriate measures.
security.txt According to RFC 9116
In addition, we provide a machine-readable security.txt at https://forgeone.solutions/.well-known/security.txt.
The format described in RFC 9116 enables organizations to provide their security contacts and vulnerability reporting information in a standardized way. This makes it easier for security researchers and automated tools to find the intended reporting channel.
Our security.txt complements the detailed Security page. It provides the most important contact and policy information in a standardized, machine-readable format.
Security Awareness Also Means Being Reachable
A security.txt does not automatically make a system more secure. Its value lies in ensuring that a person who finds a potential vulnerability does not first have to search for the right point of contact.
A clear security contact, transparent rules for Responsible Disclosure, and standardized contact information are therefore part of our responsible approach to IT security.
Found a Potential Vulnerability?
Potential security vulnerabilities in a website, application, or service operated by ForgeOne can be reported via our security contact.
Security contact:
secweb [at] forgeone [dot] solutions
