Introduction

At present Sage does not operate a public bug bounty however we recognise the need to receive responsibly disclosed vulnerabilities. This policy is intended to give guidelines for submitting vulnerabilities discovered in Sage's parent domain and subdomains for Sage products and services:

*.sage.com

Findings related to other parent domains (e.g. *.sageone.com), property of Sage Group, are accepted.

This vulnerability disclosure policy applies to any vulnerabilities you are considering reporting to us. We recommend reading this vulnerability disclosure policy fully before you report a vulnerability and always acting in compliance with it.

We are grateful to those who take the time and effort to report security vulnerabilities according to this policy. However, we do not offer monetary rewards for vulnerability disclosures.

Proper disclosure

Sage supports the efforts of the internet community to make the online world a safer place for everyone.

As a consequence, Sage’s vulnerability disclosure policy is following the latest vulnerability disclosure toolkit provided by the NCSC and the ISO/IEC 29147:2018 Information technology — Security techniques — Vulnerability disclosure guidelines.

Reporting

If you believe you have discovered a vulnerability in a Sage product then please send us an email at [email protected].

Please include the following information:

• Your name
• Your email address
• Issue type: (please select an OWASP Top Ten category where applicable)
• The website, IP or page where the vulnerability can be observed, and the affected Sage product(s) or service(s)
• A suitable risk rating and/or CVSS score
• Replication steps. These should be a benign, non-destructive, proof of concept. This helps to ensure that the report can be triaged quickly and accurately.

What to expect

After you have submitted your report, we will respond to your report within 5 working days and aim to triage your report within 10 working days. We’ll also aim to keep you informed of our progress.

Priority for remediation is assessed by looking at the impact, severity and exploit complexity. Vulnerability reports might take some time to triage or address. You are welcome to enquire on the status but should avoid doing so more than once every 14 days. This allows our teams to focus on the remediation.

We will notify you when the reported vulnerability is remediated, and you may be invited to confirm that the solution covers the vulnerability adequately.

Guidance

You must not:

1. Break any applicable law or regulations
2. Access unnecessary, excessive or significant amounts of data
3. Modify data in the Sage's systems or services
4. Use high-intensity invasive or destructive scanning tools to find vulnerabilities.
5. Attempt or report any form of denial of service, e.g. overwhelming a service with a high volume of requests
6. Disrupt the Sage's services or systems
7. Communicate any vulnerabilities or associated details other than by means described in the published security.txt
8. Social engineer, ‘phish’ or physically attack the Sage's staff, contractors or infrastructure
9. Demand financial compensation in order to disclose any vulnerabilities
10. Submit reports from automated tools or scans
11. Issue any physical attempts against property or IT infrastructure belonging to Sage or any of our IT hosting and network service providers
12. Perform attacks requiring physical access to a user's device

Report spam or phishing (please see our guidance for more information on what to do if you receive phishing emails that pretend to come from Sage). Permission is required from Sage before using automated tools or scans, performing brute force attacks, or denial of service. Any attacks which affect other users or infrastructure will not comply with this policy.

You must:

• Always comply with data protection rules and must not violate the privacy of the Sage’s customers, staff, contractors, services or systems. You must not, for example, share, redistribute or fail to properly secure data retrieved from the systems or services.
• Securely delete all data retrieved during your research as soon as it is no longer required or within 1 month of the vulnerability being resolved, whichever occurs first (or as otherwise required by data protection law).

Out-of-Scope

Sage do not have a public program, however the following vulnerabilities and types will not be acknowledged:

• Reports detailing non-exploitable vulnerabilities, or reports indicating that the services do not fully align with “best practice”, for example missing security headers or clickjacking
• Reports detailing TLS configuration weaknesses, for example “weak” cipher suite support or the presence of TLS1.0 etc
• Reports detailing any invalid or missing SPF (Sender Policy Framework) records

Sage’s Trust Hub

• Sage Security Policy

Legalities

You are solely responsible for your own compliance with law. Complying with this policy is not intended to provide you with any protection if you breach the law, nor does this policy give you permission to act in any manner that is inconsistent with the law as it applies to you or Sage.