Sony
External Program
Submit bugs directly to this organization
Sony
Our global information security team is working hard to protect Sony's information assets, services and products and the confidentiality of customer information. But we're always willing to accept more help. We recognize the valuable role that the research community plays in enhancing our security posture and welcome the opportunity to partner with you.
The Secure@Sony program accepts reports of bugs that provide a potential attacker with the ability to compromise the integrity, availability or confidentiality of Sony products, services or information technology infrastructure. Please see below for specific submission criteria.
If you believe you've found a qualifying security vulnerability in a Sony product or Web site, please submit a report in accordance with the guidelines below that includes a detailed description of your discovery with clear, concise reproducible steps or a working proof-of-concept.
When investigating vulnerabilities, avoid altering existing files, file permissions, reading sensitive information (e.g., /etc/shadow) or disrupting services. Do not utilize an identified vulnerability to pivot to other hosts or services. If sensitive information or personal information is encountered, immediately cease activities and report via the HackerOne portal where triage and Sony personnel can assist.
Reports of broken link hijacking without proof of significant potential impact to Sony will likely be closed as N/A
We value the positive impact of your work and thank you in advance for your contribution.
The Secure@Sony team is interested in the following types of vulnerabilities:
Sony reserves the right to reject any submission that we, in our sole discretion, determine does not meet the above criteria. Submissions that require manipulation of data, network access, or physical attack against Sony offices or data centers and/or social engineering of our service desk, employees or contractors will not be accepted. Submissions that result in the alteration or theft of Sony data, or the interruption or degradation of Sony systems will not be accepted.
The following submissions are not accepted by Secure@Sony:
To ensure timely and consistent responses, please avoid tagging individual team members in report comments. Our internal workflows route submissions to the appropriate reviewers, and tagging individuals can lead to delays or missed updates.
Instead, please tag the program team using @sony-team. This ensures all communications are visible to the right members of our security team and receive proper review.
Once a report is resolved and closed, the researcher will receive a +1 count on their public profile under “Thanks Received” and be listed on Sony’s HackerOne webpage under “Hackers Thanked.” Sony is also pleased to recognize our security researchers by providing a “Secure@Sony Finder” t-shirt. Sony will use the mailing address provided to HackerOne to provide the t-shirt.
Swag shipments are processed once a month but international shipping deliveries may incur a delay.
Sony will determine, in its sole discretion, whether recognition will be provided, and Sony will only recognize the first researcher to have discovered a specific, and previously unreported, vulnerability. Sony reserves the right to withhold recognition for researchers who have violated this policy in the past.
Sony is unable to provide a t-shirt if you are a resident of a country that faces United States export sanctions or trade restrictions. Sony assumes the shipping costs of a “Finder” t-shirt to the vulnerability submitter. All other country and local taxes or fees are the responsibility of the researcher. All reward decisions by Sony are final.
Sony believes in responsible disclosure and we ask that researchers:
Act in good faith, by conducting your activities under this policy, and reporting the vulnerability with us: - Promptly - In sufficient detail for us to determine the validity of the vulnerability - Without coercion, dishonesty, or fraudulent intent
Give us reasonable time to remediate vulnerabilities before talking about them publicly and notify us of your disclosure plans in advance. If you would like to disclose a resolved vulnerability, make the request directly in your report. - Whether a disclosure provides a positive contribution to the security community is a key factor in our evaluation.
Please note reports closed as Spam, Not Applicable, or Informative will not be approved for disclosure.
If we conclude, in our sole discretion, that you have complied with the requirements above when reporting a security vulnerability, Sony will not pursue claims against you or initiate a law enforcement investigation in response to your report:
Any activity determined to involve the intentional compromise of the privacy of our customers or employees or the intentional disruption of the operation of our products, services or IT infrastructure will result in permanent disqualification from the program.
We may collect information that could reasonably be used to identify you (e.g., IP address). Sony uses this information to evaluate a reported vulnerability and protect Sony products, services or information technology infrastructure.
Sony reserves the right to modify or terminate this program at any time.