Eutelsat Group (OneWeb) looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.

As a global Hybrid Satellite Network communications company powered from both Low Earth Orbit (LEO) and Geosynchronous Orbit (GEO), Eutelsat Group (OneWeb) is building an advanced hybrid satellite constellation to connect businesses, telecom, and governments with high speed, low-latency, internet connectivity. Eutelsat Group (OneWeb) brings secure, resilient connectivity, through a network of distribution partners, from pole to pole, across oceans and continents.

Response Targets

Eutelsat Group (OneWeb) will make a best effort to meet the following SLAs for security researchers participating in our program:

We’ll try to keep you informed about our progress throughout the process.

Please note that many of our systems involve technologies from third parties, and so resolution time can be quite extended. However, we will always aim to award bounty once a report is verified as valid and severity has been confirmed.

Disclosure Policy

• As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
• Follow HackerOne's disclosure guidelines.

Program Rules

• Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
• Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
• When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
• Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.

Acceptable findings

All issues reported must have a demonstrated risk associated with the reported vulnerability. Issues such as information disclosure or XSS in non-production systems that cannot demonstrate a security risk will not be accepted. Eutelsat Group's (OneWeb) Offensive Engineering team will work with researchers to demonstrate risk if a researcher needs help with proving the impact.

Eutelsat Group (OneWeb) will always accept good faith security reporting without affecting the researchers HackerOne score. Any issues discovered in out-of-scope, but Eutelsat Group (OneWeb) owned services will be reviewed on a case by case basis. This includes any critical issues found in out-of-scope services. Critical issues in test or development environments are capped at a medium CVSS score. Unless the investigation reveals the access would allow further attacks into production systems or data. The final decision for accepting reports will be based on researchers proving an issue impacts Eutelsat Group's (OneWeb) security posture.

Limitation of Exploitation

Researchers may test vulnerabilities where practical. Issues such as RCE should use a payload such as "whoami" for demonstration. XSS should use document.domain or any payload demonstrating the domain the JS code is called from.

Duplicate findings on dev/test/prod endpoints

We have several systems where products are exposed at different stages of their development cycle (e.g. dev.[product].oneweb.build vs. [product].oneweb.systems). Where these scenarios exist, we will generally regard all reports relating to the same [product] as duplicates, unless there are strong reasons to handle the reports separately.

Third Party Vulnerabilities

Eutelsat Group (OneWeb) employs third party vendors and some domains may be managed by third parties. For such submissions, the response times for triage and bounty rewards may be impacted as we are dependent on communication with the relevant third party. Please note that acceptance of third party owned vulnerabilities is at the discretion of Eutelsat Group (OneWeb).

---

In Scope

This refined scope ensures that researchers focus on vulnerabilities that can be clearly demonstrated to pose a substantial risk to Eutelsat Group (OneWeb).

Critical Authentication Bypass:

Vulnerabilities leading to complete authentication bypass.

Remote Code Execution (RCE):

RCE vulnerabilities that could lead to full control over the application or server.

High-Impact SQL Injection (SQLi):

SQL injection vulnerabilities that have a high impact, such as unauthorized access to sensitive databases or data manipulation.

Privilege Escalation with Proven Impact:

Vulnerabilities that allow an attacker to escalate privileges significantly, leading to unauthorized access to sensitive data or functions.

Data Exfiltration:

Vulnerabilities that enable unauthorized extraction or exposure of sensitive data (e.g., PII, financial data).

Business Logic Flaws with Proven Impact:

Demonstrable business logic flaws that result in unauthorized access or substantial harm.

Confirmed Denial of Service (DoS):

Although we do not allow testing of DoS vulnerabilities, if an issue is discovered Eutelsat Group (OneWeb) will work with the researcher to discover the impact.

---

Out of Scope

Low-Impact or Theoretical Vulnerabilities:

Vulnerabilities with minimal or theoretical risk, such as vulnerabilities with no Proof of Concept code.

Issues Requiring User Interaction:

Findings that require an employee, or contractor, of Eutelsat Group (OneWeb) to enable a vulnerability though user interaction. The exception is CSRF or other similar style vulnerabilities. Eutelsat Group (OneWeb) Offensive Engineering will work with the researcher to test the vulnerabilities in a controlled manner.

Informational Findings:

Findings that provide information about the application but do not demonstrate a security risk. Information disclosure vulnerabilities will be assessed on a case by case basis.

Vulnerabilities with Limited Impact:

Vulnerabilities that have minimal impact on security and pose no significant risk.

Issues Affecting Outdated Software:

Vulnerabilities that only affect outdated or unsupported software versions. Unless a demonstrated risk such as RCE with a PoC.

Known Vulnerabilities:

Vulnerabilities with patches that have only been publicly known for 2 months.

Issues with Infeasible Exploits:

Vulnerabilities that cannot practically be exploited to demonstrate risk.

Non-Technical Issues:

Non-technical issues such as legal, contractual, or policy violations.

Third-Party Services:

Vulnerabilities in third-party services not owned or operated by Eutelsat Group (OneWeb). If a vulnerability is found within a third-party service these will be assessed on case by case basis.

---

Safe Harbour

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep Eutelsat Group (OneWeb) and our users safe!