Synopsys Cloud
Cloud native EDA tools & pre-optimized hardware platforms
Request a Free Trial →
Responsible Disclosure Policy
At Synopsys, we take security issues very seriously and recognize the importance of privacy, security, and community outreach. Our mission is to work with third parties (including our customers, the open source community, and others) to improve the security and quality of the software that powers their business functions.
This policy sets forth the reporting and disclosure process that Software Integrity Group (SIG) follow when we discover security vulnerabilities in non-SIG products and services. If a vulnerability is found in a vendor’s product or service, SIG will attempt to contact the vendor by email to notify the vendor of such discovery. SIG will initially attempt to create a secure communication channel with the vendor by exchanging PGP keys for encrypted email. If a secure communication channel is successfully created, then an encrypted copy of the vulnerability report will be sent to the vendor through that channel. If no response to the attempt to create a secure communication channel is received by SIG within seven (7) days, then a description of the vulnerability will be sent by email to the vendor in plain text.
Our approach to vulnerability disclosure is based on industry standards and the Carnegie Mellon University Computer Emergency Response Team (CERT) vulnerability policy. For additional information, see the CERT disclosure guidelines.
If SIG discovers a vulnerability in a vendor’s product or service, it will take the following steps:
Actions take by SIG
Day 0 |
|
Day 7 |
|
Day 45 |
|
Day 60 |
|
Day 90 |
|
In the interest of fostering coordinated vulnerability disclosure, SIG will attempt to work with any vendor on reasonable adjustments to the above timeline if progress is being made and the 90-day default timeline is not adequate for creating a patch or other type of mitigation that addresses the vulnerability. Extenuating circumstances may result in adjustments to the disclosures and timelines when reasonably necessary.
Disclosure of Security Vulnerabilities Discovered as Part of Software Integrity Group (SIG) Consulting Services Delivery
If a new or previously undisclosed security vulnerability is found during a SIG Consulting Services engagement with a customer, SIG will follow the SIG Product Security Incident Response Process. Vulnerabilities found in SIG products will be handled by the SIG PSIRT according to SIG's Security Vulnerability Policy. If the vulnerability is in another vendor’s product, SIG will follow the SIG Responsible Disclosure Policy unless the affected customer wishes to report the vulnerability to the vendor directly; in that case, SIG will facilitate contact between the customer and the vendor, and will notify CERT /CC (or its national equivalent).
SIG will protect customer-specific data at all times throughout this process. Specifically, SIG will not share any customer-specific data unless directed to do so by the affected customer, or as required by a legal investigation.
Contact Information
Email address: disclosure@synopsys.com