Vulnerability disclosure policy

Purpose

UpSystems Solutions Canada ("UpSystems") wants to hear about security vulnerabilities in what it builds and operates, and commits to disclosing responsibly the vulnerabilities it finds in other organizations' products. This policy explains how to report a vulnerability to us, what we do with it, and how we publish.

What this policy covers

• Software, platforms and services developed or operated by UpSystems, including products published under the Blackfields by UpSystems brand.
• UpSystems websites and public-facing systems under upsystems.ca and related UpSystems domains.
• Vulnerabilities UpSystems discovers in third-party products during its research and security assessments.

Systems that belong to UpSystems clients are not covered, even when UpSystems manages them. Nothing here authorizes testing against a client environment. Problems in a third-party product should go to that product's supplier; we will help route a report if you are unsure where it belongs.

How to report

Write to security@upsystems.ca. Reports are accepted in English or French. Please include:

• The product, service or URL affected, and the version if known.
• A description of the vulnerability and its impact.
• Steps to reproduce, or a proof of concept.
• Whether anyone else has been told, and any disclosure date you have in mind.
• How you want to be credited, or that you prefer to stay anonymous.

What to expect from us

• A person acknowledges your report within 3 business days.
• We give you our assessment within 10 business days: confirmed, not reproduced, or out of scope.
• We keep you informed until the issue is fixed, and we agree on a publication date with you.
• We credit you in the advisory unless you ask us not to.

UpSystems does not run a paid bug bounty program.

Rules for good-faith research

We ask that you:

• Test only what this policy covers, and stop once you have shown that the vulnerability exists.
• Do not access, change or delete data that is not yours, and report any personal or client data you come across without keeping it.
• Do not degrade our services: no denial of service, no spam, no destructive testing.
• Do not use social engineering against UpSystems staff or clients, and do not attempt physical access.
• Give us a reasonable time to fix the issue before telling anyone else.

Safe harbour

If you follow this policy in good faith, UpSystems considers your research authorized, will not start legal action against you over it, and will say so if a third party does. This commitment cannot bind anyone other than UpSystems.

Vulnerabilities we find in third-party products

• We notify the supplier privately and confirm they received the report.
• We publish 90 days after that notification, or when a fix is released, whichever comes first.
• We may extend the deadline when a supplier is actively working on a fix and asks for more time, and we may publish earlier when a vulnerability is being exploited.
• When a finding comes from a client mandate, we disclose it to the supplier without any information that identifies the client.

CVE IDs

Vulnerabilities covered by this policy that meet the CVE Program's criteria receive a CVE ID. UpSystems currently requests CVE IDs from the CVE Numbering Authority (CNA) whose scope covers the affected product.

• When another CNA's scope covers the product, that CNA gets the first opportunity to assign, and we refer the report to it.
• When a CVE ID is assigned for a vulnerability you reported, we give you the ID.
• The CVE record is published within 72 hours of the public disclosure.
• To dispute a CVE record tied to one of our advisories, write to security@upsystems.ca. We acknowledge disputes within 3 days.

Where we publish

Advisories are published on the Security advisories page. We may update this policy; the effective date at the top of the page shows the current version.