Vulnerability disclosure guidelines

Safety and security of products, services or assets made by or belonging to Airbus are of utmost importance in our industry. We welcome any reports of potential vulnerabilities related to our products, services or assets that you may submit in good faith and in accordance with these guidelines.

IMPORTANT: If you are a customer, supplier or contractor of AIRBUS products or services you should contact your Airbus business point directly rather than use this process.

Safety First!

AIRBUS is strongly committed to safety and security and therefore urges you to not do anything that could harm and damage yourself or others.

How to report?

Send your English language report by encrypted email (Please use the Airbus PGP public key) to: [email protected] as soon as possible after the discovery of the potential vulnerability together with the following information:

• Description of the vulnerability;
• Details to reproduce;
• Discovery timeline;
• Related product, service or asset;
• Your contact details including your PGP key.

We will acknowledge receipt of your report in a timely manner, usually within 72h. If you do not receive any acknowledgement receipt from Airbus within this timeframe, please re-submit your report to ensure we have received it.

What’s about trust?

We may need time to assess and fix any vulnerability. We rely on you to provide us with reasonable time before sharing or publishing any potential vulnerabilities to the public or third parties. Please keep in mind that any public disclosure or sharing of information concerning any unresolved vulnerability may cause harm and expose your responsibility.

We respect the interests of the reporting party and anonymous reports are welcome.

Note: AIRBUS does not operate a bug bounty program. We do, however, recognize reporting parties who have brought an acknowledged security vulnerability to our attention. AIRBUS is working to set up a public Hall of Fame. Only reporting parties who express a wish and authorization to be named will be listed in the Hall of Fame.

Be ethical and compliant!

The purpose of these guidelines is to ease the disclosure of potential vulnerabilities in an ethical way and in accordance with the law. They shall not be construed as a permission to infringe any law or to reverse engineer any code or other technology.

Disclosure of any vulnerability will comply with the following principles:

• Do not cause any harm to AIRBUS, our customers, suppliers, partners or any other individuals or companies;
• Do not act so as to compromise safety of our products, their operation and/or related services;
• Do not infringe any applicable intellectual property rights or trade secrets, laws or regulations;
• Do not lock, disclose, destroy or compromise integrity of Airbus’ and Airbus’ customers and partners’ data;
• Do not turn a financial transaction into a precondition to the disclosure of potential vulnerability;
• Do not breach any applicable data privacy laws and regulations.

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGVTiOMBEADCRBao44pdm+kT/hlRZibnLw9nCmTvjnKXXh8aQVqrO0rDGmvw
I0t+XXhfjpplyb/WaSPfPrOYCBl5etY/XezA9UHv+Zacayn1v5+ZC9fPspwZnA9n
hBjqGW9QHm4gEl2lyC7lz28oDjoeT00YmpsffeW1iot4rYSF4nD9h2Ws+anZh7M1
OY4xm+AJMeioq4UFIbJB+ezn50zBceIlUK5J3q3tSciS0TEDEtEEX48qTUXE+AjB
0wdCbwoVxpBNkDMl8pWLGB+tAPJVnp/FM+OmnH6XSeuFuAnHMoaDhLBzXGmWpD8+
BHgneRKYBC860MPYv+jopzkmVgg8D8UepzbqBIo6EGKZpJoL9ggPA0fsA8TSafcc
V/gTt7P7HXp2kUCRE1U2qg6J7KBX3r3WGHIFYWa5adDR27Jv4xZR9o+xMO+VJvNR
UeuebBAi0YQP90nAsxlj1Wh9CpHBckUayuwbWro1eV5krK5EOL8GHcP3yXKhBl+3
9tTQ22ydw1qbrXRQCyfINbAnvTOGn2t2dYSIC4Cl5ltuHQLPwLqEgq74/Fnq6lv/
sF4OZI058Z0jqfjaCgDctnFyfadWqHseTmsJU/HcXqFyI45/8f/qOqIFIU8OuVh9
m0OUw3r14XqkV2lrDpCPbNBLFJidkAiDEWxTw5XezvACw43S4qSCFrc8FwARAQAB
tElBaXJidXMgU2VjdXJpdHkgKFZ1bG5lcmFiaWxpdHkgSGFuZGxpbmcgYW5kIERp
c2Nsb3N1cmUpIDx2dWxuQGFpcmJ1cy5jb20+iQJUBBMBCgA+FiEEhB5wfJf2jVG2
XbIHsN9kG94VlmQFAmVTiOMCGwMFCQWjmoAFCwkIBwIGFQoJCAsCBBYCAwECHgEC
F4AACgkQsN9kG94VlmRmMw//UZdLvHry88pPHxnmREE//xCAACB9NZNpr0VAERYf
cMBJ/P7Jqhty/pHRNvY/3MiCyUxPQcr9gaF58n+Lpech9z6+tyeV54zOBy1Wvpo+
Fv12Qmp0RDpP+Tv801fRPyrgxoM9FLWf7WsZcQ0+N0u/u8nq9GfRB6GhxxRMxhht
iuP0iJ+hpkDU3OAM2smeDjzn8inugSVQ9918yF8DsxO/0Pp4GcxjnmnnApgJBymC
si6KQYNh6BNqwp+EQNVJHk8ruWzGQ7DPC5tz9/+D9e46qlXcqXNUQOy+8irawA91
5QHV6k5bYbAKCMrFeKkpJJNZkOXye+ItOI6km4g2AhYsVVjrUkB3x5X/8k1QQ4RD
ymIdDSRRCAhcB9rP89OTC8Hcez3xCjUIiD7ikCrRj70IQKpijQEE/Am6pnBKbZLH
DMmKqWT5W2VlDKIf+n8K1+4HUj2f6AABJBC5hgh/X5IssUWpn9kYYt2qnbE8ttfx
oz036KKBAdUaKPTqlMlegt0dWUkHkjqpJ1t/xw5m40o5Hnr3Ypf2QsJWxs9ih7GI
RHFfEV8DsKsuz2ur5kgiaRkff0mPe2wwQkTHGBdFy912Y60MaZVGOd5twSrtj8IG
YuUgocW2+/r079KupfTdURerWhz1x0JnOYcF3z9KW81EHdtYKJh4iVtStpj2v1lE
ZVi5Ag0EZVOI4wEQAPzewT65Kgw/i1xHb3xZZA2xCga+7r38rpNWmn9zlcNEVx+v
O6NKD6zKb9n0vaIFrf9WrPd/x9M7L27u4Mn8ZAXnlXtv4kkXZgOZPm8jiPr507qs
7DgobgASD6JhA1SGsWbmFhtredp5z9bR0diNp9Q3QbRpW3rl0Mx1dSem0qSr6EAY
Wx6MOE5cjEiApZqSLfvdc1nu5+J/BRlt69Z0IMr36YOHEQeBnZoaIlKWAT6Shi2D
2elr5yVBfCcNjbSoz+Q8arRksekCNdW79L1auC9MtmwFeH6nIc9dLQ5ng+jffIuF
iiGy4FtWqQ2f1aipTYQssBNWqjk5CIxD7m6vuYHJ5jkR4vJ7HxDXG5vlrssIjdVZ
cgYzFABgfq3hWBkLw6ZALxu26TeovVzzUXqGSymM39us9u8jaWFqvVTB4y7Lg3Kl
cM7r2jFp1JaI8Vb2yvu9Y5xb71k5myqpYrRpCmzgd2s4OHAWh5i4SroV9o6xCdj+
AAKYZRlyOViilbfJvuKbDO5klpUj5PEj+ISxjqUXpZ0gVe9Tnm/unevpCKYRCj3x
MVmIV0flUQW6KRKLo+CLY18HxCIbFNSuNFPfhw1myBYSvTvvULhhieBXBM9IL2AS
3Y36V76ul1R3oWehShdqKq+zha08Fks03619BRm8OEmqsA3vOkvMaq/LUuNtABEB
AAGJAjwEGAEKACYWIQSEHnB8l/aNUbZdsgew32Qb3hWWZAUCZVOI4wIbDAUJBaOa
gAAKCRCw32Qb3hWWZFJaD/4zT9CrHkAN80vDDeeGTqODZWNQDS/wr16tStCHT0uH
ezlPqlcrHjdKrpUPl3ZoT7Bl22qPpwUjJRfa9aECscLUpJaC/JUBRcXeeUrijb21
cfHPN58mSnUWedcTxRi5lEzIjwRyI8V65c9kJyv5U6LkzVdFhUtzUFxrS9otDyHy
ATCBz+ol3L/d32sjZD5ZthRJU8MqcsjgFD41dNIfFB5da2G7GyPPFgE5SkloJEeL
BXDJ/GKUDVdFcsU7qvkiiZzhmXLYk7fn7QrqD2zkPqgAR0vuJSdXTsQkAJcBh5Wt
FnZoQHZUldjKFxhaFoCKlokDqlThX2jng2kEg+qyzhrKifgsXZFSHCzGkoeHNWQG
ALFyebHg1zdSt8HQmy0ZldnKdWDEgZ1RRheK7zIB1WJt5nm6nfOLuxTwem9l4yrI
yOTm3uw9dgjmSBPdLVT4wC0+ZMnWgC5bn+ZAJqkMpWBvinJjQyCcvUwhPSGIMmKs
o80JuTh7Ojxfn0BFU162yuPe0pUyNcyN4AbSrwJpbknCsiOSD/2IMZe8zcJegR4H
ZFovQgWvkytrYQC8gnq9Sr0UwueygweO/iHJcLFnK+z0DI8JTebLRGQghPtvPjEK
w5VQORF3RAbH4M21A7IKp6pzX2zLZP9CTWglDWaGhqBSghlxMrPGHj0kMcQm8yP+
vbkCDQRlU4lnARAAvyatMU/OzLyTq4hCq/qtH32sFM2riMr4lOEXsrDzmB1wTeip
zN9fqhjA0KBaQ3KW6fWlve6I1Ra0ySGv9QyeHkyTN8KV8vHOTRkEwJ3BE7YIoRyO
8aWMh7Q0xIEbV0SqanDoVKrNz6flMprJEPLc8VLjWam3a59iljmN2DPsvaqMsxQw
h8KfmALPrGyuT/H76GkYxp+cIyqOs61wo9FUga3xgcuPcAXlcOB/C3F4qEfNjPAz
YkSYDVM8cdqdpUp23YVlOuYGcwX9JlWTJxdnUmUUKdG75rsVQ/jyVjYeFTs18GWC
Z2y7jSURW7rpN+eSYH8EtXI5FHGEFQmXU3DUpc9vlXElBMLwheEft4ZGIqELmCIL
4blhjaMWNQfNu2fduzk9A84lsBMmxvPmKQPe1S5A9Iobz2cw1W8Y30+SIfIsQ8Ia
jrMw5ggHepXlQXkynl03JheKOi8QRXzIjiFn3yfDg+a1/a7pT0JYBgRlR9GKHk46
uXQEEh1FXBS3Vsmtc4SeElZY7io1pa0HIukmyiLOkVaRaTymCP5kGSn6Y9f2A+ax
rVmrBSY/4EDMNlykhFIrYv82emEATtnNW0aOHTsKo27mrDDbm8zoNxaN1aWUzEFp
xOuaZ9r7enQc+mWjSfnDLUZTBHLXvwPaKxDJCFb1jrs4cQCQ+Qjou+Xo5k0AEQEA
AYkEcQQYAQoAJhYhBIQecHyX9o1Rtl2yB7DfZBveFZZkBQJlU4lnAhsCBQkFo5qA
AkAJELDfZBveFZZkwXQgBBkBCgAdFiEEFDwnn0ugXWq8wk4C588TDmb8ZhgFAmVT
iWcACgkQ588TDmb8ZhhoiRAAs2Lq5zYXj0RCKk3Yid2NU+8C8a9aVJNCWCbWLEzo
Gb55WnJvGXzNbCQJvFPe4tOLsB+8BSj7q9NW4uOR4HljjWakxifYhormxeRkPJZK
RxQy3T4KvusiUFl7t2J1xyJNCrrvYeK6ua1Rk1quxWqtzVKfte3BGU53zTYtKAT7
B/jnyW45O1CWU89fUmVDxDr+UfG3ivApcxJgsACIM3AAevHQ25X5tBghPL2S5N+m
lvClH1A9DWNMYSnKHo1gUmvOKBa+bI06FC+bAFGnVX8EU0ooQtnje15Sr6OOhNuN
xJ24VrVJtsAFmKUpB0vh70eNRmCfT85dKiSTzjfm62rvlmCxbhsaBVFc+bKMgt7l
JaiFzKuWRrZ24tT+6wZ/Bn/sYc38NwA0CpXVUZiq6okzTI5rOaktSMnFVlYZPpRD
GiEnb3lq9nPJg4g+EgKA5v4PP0Q6abETD0R1b99Gx8EXqoLdW/rXbp0Qu3OA1gD4
+/Ez7Pp3GX8vCq5ze99o9c8fiVJzn5pXqS0TVXdRK2+Sh0/TqCr30C2MRvIp1tJ4
NCTfx3rklNHk+ROnSbA+tzsIY/Bn1Nl+Ynid8YP9peyqOXlpomLu8TnIDiEbSiDw
yt93aB85a4EbarywMkg+ecwZUxc3IaeOjHiIYvqnnpwhE1gkj4NGNo5iFeFU7jUa
agJB2g/44vGtHkM9AaMaRkGFlc4KfRwvc5/Hu5PdZymPhohJzHS+oz/hANWbjMcv
PunTUwZ5WthoYdLd5s9Q66BTCMVetqYl5J0r5LYSlHZQv56e+z8RxUL1RhZt8kTV
QHOnQRIlRVs+af36nSYnzRlJeSCJbZATapu22rHZPj7R2tVTyYrwZX+2Bla+Hqow
CecLi3oMmYF9HLVkEHs0CQmx4pvgkh6bBcq8seAIHTCC5DcP7tkbk/Hs0J447cAY
/2UOEb/AtGgnKQ4+GL2Kvh1/btx5m+nt97uabzfVleX1xIt5yVM+M3mCVj0ov/cL
/l8vqDXsZqgPb5csmjevf/rOVougnV8+0ntzyZlz6g7ThGa0xXrL5HWuee8BLOOF
+tLItYlaCnyVaNBWkhW83dYFdkWgiMz9ayW7DLtM2UTTbuQ/Q11+GZXGebzN6dVi
uh1uM8ViS129xTpYxdhHVoAPydvbuglmVmdFnsW4x6AuSmBJh8QCdWSNMz1tLYHo
aYDHP+DjRGE2iGfO3ifVOGrJuJe+u+vXGL51LJmOOwLhkjjXU46R1joISfBA4Pny
X60RVnE0o6mOiXhOSza8E8dAl5Mu/LZ/Wxkpa+LgJV6c39eSyyqG3GC2bsm0XThs
uwTvlnTXJCYeMXfq2+DZySNWGKVMPOk2c8GgZhP8ccXQi+ekobkCDQRlU4mOARAA
u2qZAgXQtZdGrJKmGp4H3QzMREjkXA0WT/X0sMVOUKrqzVrdrLh1c0jnk0mhO6+I
4xSSKfdadNirAM1S2CpWv4vC+LZlcLiRLfUvl30x0A8t4mE7F4pKuiRZQo0K+8dZ
U7j2hbGoYp+68SVIlLWNI7HtPWRHJfTvSgNOe8CzrC760DiDLpcYlRrKqSPe2AEs
cVsbcr7fECRYq6IPpvuRr966CVzHL0z9b/mhrp4H8FmFYmR2g2e1dpo4TcC5xkwe
UorhotZRF4y2Mn3jlUl5RoQOXp6/LnPq+V5y5IJJ9oHSU50pFofSbDbxTbGazh7i
T1+Np/w1UfMsrWnSwG/WEuYlIy/g6UAkB9rszMaTSaRWFX9SEioMS9lYr3bcrOZ+
/DICZJqAAlaSf6jFcnRNUD/JwE4JEqTY8sFWmgvmJbLwEbFDQl+7NO/MGEOdNrbW
LQsVJYozIRe39Wmz00xRvrPhBVNDt5+HfAcv2jpDmWhJZggIosXPuXIfCcruHLOz
EYH9YNjH1uqNj7+TmMyxp7Q5ogpiP4WTH7WvdVvCjt6vCuVBx7u9D8D6PkD7PA/E
2GE7OqOo31WV9P+3TvMYgdPfP/652+Q19LskTg1aE/yjG3oejibnGJiKJn78/9Ev
Rid3jCiA2qNYbIx+vobjGY+ZV+MzSdCkNM29H1Kpc28AEQEAAYkCPAQYAQoAJhYh
BIQecHyX9o1Rtl2yB7DfZBveFZZkBQJlU4mOAhsgBQkFo5qAAAoJELDfZBveFZZk
BAAQAL+U4jpz+qk04XWs5qL5ooWJW2K+p3hRfkM55ukkf8pSqs0O9hS2C3Vrxn7g
EYH41FmbYrJLu91oZWydNnlCAMh00Uo3zAgCsFa9kDnEKlbty2oJy2T/91fFh5rf
EtyyUmQ5z13eqYkg5/X90A+H2rfxcvJZxBLr/bsUmY1KisH0n/gNRiWJzAOwVRkT
9/U2SWMAixAmszv1GyGApIbtZNct2+gZ6jt8+Nx3kIbVpowpt/eLZ9nw1/xqTwQo
6/9QgshItwzogbSd3CY0xOPBmHt46XsZE7wQc0JKetA8ZiYK58DU7Mv3cYaZzZkK
WRR6FTok4MqdG4gOLLQmmhRjfdEXYLwLwhB0Tf9VByX49wpCN+yDrhjCuT2MO+JF
6U3dEmHQOVAziWaZcbzL1MzsFt6vR6JAqst44Hjzc7m6H9nXmgZaDHgEYnFYtVLd
zSqXgcaB8yxYilre6hf8BcDsO5T1BnOCbZ0yZRcY4vQZS4HAwj0U+c4vsqRKTGOd
M5zYyH63A0fbcghmM0N+9MXXuBWuXn9CCOblTozT72rEq1ON8ZuHHh4eNN4OCj9j
q0Jk/eGqQiee+M7J/uXUU1LbZj/oHTl51xX1gFGL97ccU2sw50hfhHD/O2GRVpHw
a7gvgs6UpaQoqoYK2IyGR0JdsML9Wzn3ijBgDN1UAi//jSgb
=Qv8c
-----END PGP PUBLIC KEY BLOCK-----