Our Commitment

 Keeping data safe is critical to Weber, our customers, and the security experts who watch for vulnerabilities. For that reason, we have adopted a responsible disclosure policy. If you are a security researcher, this policy affirms Weber’s commitment to keeping data secure and explains how you can help us maintain our commitment to high privacy and security standards.

 

Our Responsible Disclosure Policy

If you think you have found a security vulnerability in one of our products, mobile apps, or web services, we want to hear about it.

 

• Let us know as soon as possible of any potential security issue.
• We ask that you give us a reasonable amount of time (see Response Targets, below) to respond to your report before making any information public or providing it to any third party.
• We will keep you informed about our progress throughout the process.
• Please don’t access, use, or modify user data without permission of the account owner.
• Act in good faith, particularly to avoid degrading the performance of our services.
• Please do not attempt denial of service attacks, social engineering (e.g. phishing, vishing, smishing), physical property or infrastructure attacks, infringe third parties’ intellectual property rights, spam our users, or engage in other similarly questionable behaviors.
• We may offer a reward (i.e. bounty) for legitimate, original, and reproducible issues reported. Awards are at the sole discretion of Weber.

 

Response Targets

Type of Response	SLA in Business Days
First Response	5 days
Time to Triage	10 days
Time to Bounty (if applicable)	30 days
Time to Resolution	Depends on severity and complexity

 

Out of Scope Vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

 

• Clickjacking on pages with no sensitive actions.
• Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions.
• Attacks requiring MITM or physical access to a user's device.
• Previously known vulnerable libraries without a working Proof of Concept.
• Comma Separated Values (CSV) injection without demonstrating a vulnerability.
• Missing best practices in SSL/TLS configuration.
• Any activity that could lead to the disruption of our service (DoS).
• Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
• Rate limiting or bruteforce issues on non-authentication endpoints.
• Missing best practices in Content Security Policy.
• Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.).
• Vulnerabilities only affecting users of outdated or unpatched browsers (Less than 2 stable versions behind the latest released stable version).
• Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case by case basis.
• Tabnabbing.
• Open redirect - unless an additional security impact can be demonstrated
• Issues that require unlikely user interaction.

 

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and Weber will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

 

Report an Issue  CLICK HERE