
Sage
External Program
Submit bugs directly to this organization
At present Sage does not operate a public bug bounty however we recognise the need to receive responsibly disclosed vulnerabilities. This policy is intended to give guidelines for submitting vulnerabilities discovered in Sage's parent domain and subdomains for Sage products and services:
*.sage.com
Findings related to other parent domains (e.g. *.sageone.com), property of Sage Group, are accepted.
This vulnerability disclosure policy applies to any vulnerabilities you are considering reporting to us. We recommend reading this vulnerability disclosure policy fully before you report a vulnerability and always acting in compliance with it.
We are grateful to those who take the time and effort to report security vulnerabilities according to this policy. However, we do not offer monetary rewards for vulnerability disclosures.
Sage supports the efforts of the internet community to make the online world a safer place for everyone.
As a consequence, Sage’s vulnerability disclosure policy is following the latest vulnerability disclosure toolkit provided by the NCSC and the ISO/IEC 29147:2018 Information technology — Security techniques — Vulnerability disclosure guidelines.
If you believe you have discovered a vulnerability in a Sage product then please send us an email at [email protected].
Please include the following information:
After you have submitted your report, we will respond to your report within 5 working days and aim to triage your report within 10 working days. We’ll also aim to keep you informed of our progress.
Priority for remediation is assessed by looking at the impact, severity and exploit complexity. Vulnerability reports might take some time to triage or address. You are welcome to enquire on the status but should avoid doing so more than once every 14 days. This allows our teams to focus on the remediation.
We will notify you when the reported vulnerability is remediated, and you may be invited to confirm that the solution covers the vulnerability adequately.
You must not:
Report spam or phishing (please see our guidance for more information on what to do if you receive phishing emails that pretend to come from Sage). Permission is required from Sage before using automated tools or scans, performing brute force attacks, or denial of service. Any attacks which affect other users or infrastructure will not comply with this policy.
You must:
Sage do not have a public program, however the following vulnerabilities and types will not be acknowledged:
You are solely responsible for your own compliance with law. Complying with this policy is not intended to provide you with any protection if you breach the law, nor does this policy give you permission to act in any manner that is inconsistent with the law as it applies to you or Sage.