Vulnerability Disclosure Policy
Introduction
Maro values the security of our systems and the data of our users. If you believe you have discovered a vulnerability, privacy issue, exposed data, or other security concern in any of our assets, we want to hear from you. This policy outlines how to report such issues to us, what we expect, and what you can expect from us.
Systems in Scope
This policy applies to any digital assets owned, operated, or maintained by Maro.
Out of Scope
- Assets or equipment not owned or maintained by Maro.
- Vulnerabilities discovered or suspected in out-of-scope systems should be reported to the appropriate vendor or applicable authority.
Our Commitments
When you report a vulnerability to us in accordance with this policy, you can expect us to:
- Respond to your report promptly, and work with you to understand and validate your report;
- Strive to keep you informed about the progress of a vulnerability as it is processed;
- Work to remediate discovered vulnerabilities in a timely manner, within our operational constraints; and
- Extend Safe Harbor for vulnerability reporting that is related to this policy.
Our Expectations
When reporting a vulnerability to us, we ask that you:
- Follow this policy and any other relevant agreements. If there is any inconsistency between this policy and any other applicable terms, the terms of this policy will prevail;
- Report any vulnerability you've discovered promptly;
- Do not actively scan, probe, or test our systems for vulnerabilities. This policy covers the reporting of vulnerabilities discovered during normal use of our services, not active security testing or penetration testing;
- Avoid violating the privacy of others, disrupting our systems, destroying data, or harming user experience;
- Use only the Official Channels to discuss vulnerability information with us;
- Provide us a reasonable amount of time (at least 90 days from the initial report) to resolve the issue before you disclose it publicly;
- If a vulnerability provides unintended access to data: do not access or modify any data beyond what is necessary to confirm the issue exists, and cease activity and submit a report immediately if you encounter any user data such as Personally Identifiable Information (PII), Personal Healthcare Information (PHI), credit card data, or proprietary information;
- Do not interact with accounts you do not own or do not have explicit permission to use; and
- Do not engage in extortion.
Official Channels
Please report security issues via [email protected], providing all relevant information. The more details you provide, the easier it will be for us to triage and fix the issue.
Safe Harbor
We consider good-faith reporting of vulnerabilities under this policy to be authorized and beneficial activity. We will not initiate or support legal action against you for reporting a vulnerability in accordance with this policy.
This safe harbor applies provided that:
- Your activity was limited to reporting the vulnerability and did not involve active exploitation, unauthorized access to data, or disruption to our services;
- You complied with all other terms of this policy; and
- Your actions were conducted in good faith.
You are expected, as always, to comply with all applicable laws. If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
If at any time you are uncertain whether an issue you have encountered falls under this policy, please contact us through our Official Channels before taking any further action.
Note that the Safe Harbor applies only to legal claims under the control of Maro, and this policy does not bind independent third parties.