Hyundai Motor America and Genesis Motor America appreciate the efforts of security researchers and welcome any information that could lead to the identification and remediation of a cybersecurity vulnerability in Hyundai Motor America and Genesis Motor America products. We will investigate and respond to all legitimate reports submitted according to the instructions below in a timely manner. Vulnerabilities and/or issues found on products, services, and IT environment outside the USA are out of scope for reporting to this vulnerability disclosure program.

==This is a Vulnerability Disclosure Program (no bounties are awarded). If you believe you have found a security vulnerability in an application or services owned by Hyundai, please submit your finding here.==

Response Targets

Hyundai Motor America and Genesis Motor America will make a best effort to meet the following response targets for hackers participating in our program:

We’ll try to keep you informed about our progress throughout the process.

Disclosure Policy

• As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
• Follow HackerOne's disclosure guidelines.
• If you identify an issue that you believe could be a cybersecurity vulnerability in any Hyundai or Genesis product or service, please contact us at https://hackerone.com/hyundai-genesis/. We will be sure to respond promptly to your report. By submitting a report, you agree that Hyundai Motor America and Genesis Motor America may use the information in your report in whatever ways we see fit. Hyundai Motor America and Genesis Motor America utilize HackerOne services for reporting management. Please refer to the HackerOne terms and conditions at Hackerone.com/terms.

Program Rules

• ==The scope of this program is limited to Hyundai Motor America and Genesis Motor America USA assets. We do not own (and therefore cannot remediate findings on) non-USA assets. For this reason, any reports submitted on non-USA assets will be closed as N/A.==
• Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
• Submit one vulnerability per-report, unless you need to chain vulnerabilities to provide impact.
• When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).
• Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
• Social engineering (e.g. phishing, vishing, smishing) is prohibited.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts, vehicles, and devices you own or with explicit permission of the account, vehicle, or device holder.

By submitting a report under this program, you agree not to:

• Engage in testing or research that may harm or put at risk Hyundai Motor America and Genesis Motor America, their employees, their customers, riders in their vehicles, or other third party individuals or entities including Hyundai Motor America and Genesis Motor America related dealerships and dealership employees
• Disrupt, compromise, or harm any vehicle or data other than that which you own
• Access or disclose personal information belonging to Hyundai Motor America and Genesis Motor America, their employees, their customers, riders in their vehicles, or other third party individuals or entities
• Compromise or disclose confidential or proprietary data belonging to Hyundai Motor America and Genesis Motor America, their employees, their customers, riders in their vehicles, or other third party individuals or entities including Hyundai Motor America and Genesis Motor America related dealerships and dealership employees
• Test the physical security of any Hyundai Motor America and Genesis Motor America properties or facilities, or the properties or facilities of Hyundai Motor America and Genesis Motor America affiliates or related third parties. This includes Hyundai Motor America and Genesis Motor America affiliated dealerships.
• Perform any kind of denial-of-service testing or over-exhaust an IT function
• Perform social engineering, spam, or phishing/spear-phishing attacks
• Perform any testing or research on systems or technology located outside the United States
• Disclose to any third party the details of any submitted vulnerability reports before Hyundai Motor America and Genesis Motor America can confirm complete remediation of the identified issue (if any)
• Participate or submit reports if you are employed by Hyundai Motor America or Genesis Motor America, or an affiliate company or a Hyundai Motor America or Genesis Motor America supplier, or are acting on behalf of someone employed by Hyundai Motor America or Genesis Motor America. If you are a member of one of these entities, please report the issue to your management, who is then to report to Hyundai Motor America or Genesis Motor America, directly.

Terms

In submitting reports, please note that although Hyundai Motor America and Genesis Motor America sincerely value vulnerability reports, we do not provide monetary compensation (“bounties”) or non-monetary remuneration in exchange for submitted reports. This program is only meant to facilitate the responsible reporting and resolution of cybersecurity vulnerabilities.

Report Submissions

When submitting reports, we expect that you will:

• Describe the alleged vulnerability and, where possible, include proof-of-concept code to facilitate our analysis and triage of your report
• Describe the methods you employed to identify the alleged vulnerability and any known or possible remediation
• Confirm that you are not on the U.S. Department of the Treasury’s Specially Designated Nationals List or other restricted party lists maintained by the U.S.
• Finally, please comply with all applicable laws and regulations in all work related to this program

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Thank you for helping keep Hyundai Motor America and Genesis Motor America and our users safe!