{"id":9348,"date":"2019-12-09T22:22:48","date_gmt":"2019-12-10T05:22:48","guid":{"rendered":"https:\/\/grin.co\/?page_id=9348"},"modified":"2026-02-13T11:11:32","modified_gmt":"2026-02-13T18:11:32","slug":"security-vulnerability-disclosure","status":"publish","type":"page","link":"https:\/\/grin.co\/security-vulnerability-disclosure\/","title":{"rendered":"Security &#8211; Vulnerability Disclosure"},"content":{"rendered":"\n<section id=\"section-c5b44a4\" class=\"section-c3dd34b cc-sct\"><div id=\"section-c5b44a4-wrapper\" class=\"section-c3dd34b-wrapper cc-wrapper\">\n<h1 id=\"heading-c867315\" class=\"heading-cb3fda1\" style=\"--ccaos-duration:0.3s;--ccaos-delay:0s;--ccaos-easing:ease-in-outs;\" data-aos=\"fade-in-down-small\" data-aos-once=\"true\">Security Vulnerability Disclosure<\/h1>\n\n\n\n<div id=\"div-c503478\" class=\"div-c43f206\"><\/div>\n<\/div><\/section>\n\n\n\n<section id=\"section-cb70b49\" class=\"section-cef8eae cc-sct\"><div id=\"section-cb70b49-wrapper\" class=\"section-cef8eae-wrapper cc-wrapper\">\n<p id=\"paragraph-cf451de\" class=\"paragraph-ce7eefc\"><strong><strong>Purpose<\/strong><br><\/strong>GRIN is committed to maintaining the security of our networks and protecting our customers&#8217; data. The security researcher community regularly makes valuable contributions to the security of organizations and the broader internet, and GRIN recognizes that fostering a close relationship with the community will help improve our own security. GRIN accepts and acts on vulnerabilities discovered by security researchers.<br><strong><br><strong>Scope<\/strong><br><\/strong>GRIN has set the following boundaries for security testing. In scope is the following websites.<br>https:\/\/grin.co\/<br>https:\/\/app.grin.co\/<br><strong><br><strong>Out of Scope<br><\/strong><\/strong>While we encourage you to discover and report to us any vulnerabilities you find in a responsible manner, the following conduct is expressly prohibited:<\/p>\n\n\n\n<div id=\"list-c5b15f3\" class=\"list-cb71f94\"><ul><li>Performing actions that may negatively affect GRIN or its users (e.g., Spam, Brute Force, Denial of Service\u2026)<\/li><li>Accessing, or attempting to access, data or information that does not belong to you<\/li><li>Destroying or corrupting, or attempting to destroy or corrupt, data or information that does not belong to you<\/li><li>Conducting any kind of physical or electronic attack on GRIN personnel, property or data centers<\/li><li>Social engineering any GRIN employee or contractor<\/li><li>Conduct vulnerability testing of participating services using anything other than test accounts<\/li><li>Violating any laws or breaching any agreements in order to discover vulnerabilities<\/li><\/ul><\/div>\n\n\n\n<p id=\"paragraph-ceb41fe\" class=\"paragraph-c05962a\"><strong><strong>Safe Harbor<\/strong><br><\/strong>GRIN pledges not to initiate legal action against researchers for penetrating or attempting to penetrate our systems as long as the security researcher adheres to this policy.<br><strong><br><strong>Process<\/strong><br><\/strong>In order to submit a vulnerability report to GRIN\u2019s Security Team, please utilize the\u00a0<a href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Vulnerability_Disclosure_Cheat_Sheet.html\" target=\"_blank\" rel=\"noreferrer noopener\">OWASP Vulnerability Disclosure Cheat Sheet<\/a>. GRIN has set the following criteria for vulnerability reports.<\/p>\n\n\n\n<div id=\"list-c8421c9\" class=\"list-cb21862\"><ul><li>Well-written reports in English will have a higher chance of being accepted.<\/li><li>Reports that include proof of concept code will be more likely to be accepted.<\/li><li>Reports that include only crash dumps or other automated tool output will most likely not be accepted.<\/li><li>Reports that include out of scope sites will be ignored.<\/li><li>Include how you found the bug, the impact, and any potential remediation.<\/li><li>Send email to security@grin.co and include any plans for public disclosure.<\/li><\/ul><\/div>\n\n\n\n<p id=\"paragraph-cefebc5\" class=\"paragraph-cca904e\"><strong>What you can expect from us:<\/strong><\/p>\n\n\n\n<div id=\"list-c5e8300\" class=\"list-c203a74\"><ul><li><span>A timely response to your email (within 2 business days).<\/span><\/li><li><span>An open dialog to discuss issues.<\/span><\/li><li><span>Notification when the vulnerability analysis has completed each stage of our review.<\/span><\/li><li><span>An expected timeline for patches and fixes (usually within 120 days).<\/span><\/li><\/ul><\/div>\n\n\n\n<p id=\"paragraph-c74859d\" class=\"paragraph-cc3d0db\"><strong><strong>Public Notification<\/strong><br><\/strong>If applicable, GRIN will coordinate public notification of a validated vuln\u00ceerability with you.<br><br>When possible, we would prefer that our respective public disclosures be posted simultaneously.<br><br>In order to protect our customers, GRIN requests that you not post or share any information about a potential vulnerability in any public setting until we have researched, responded to, and addressed the reported vulnerability and informed customers if needed.<br><br>Grin does not authorize public disclosure of any security-related reports or details about our systems without our explicit written permission.<\/p>\n<\/div><\/section>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"landing-pages":[],"header-type":[],"class_list":["post-9348","page","type-page","status-publish","hentry"],"acf":{"subtitle":""},"_links":{"self":[{"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/pages\/9348","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/comments?post=9348"}],"version-history":[{"count":5,"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/pages\/9348\/revisions"}],"predecessor-version":[{"id":52359,"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/pages\/9348\/revisions\/52359"}],"wp:attachment":[{"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/media?parent=9348"}],"wp:term":[{"taxonomy":"landing-pages","embeddable":true,"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/landing-pages?post=9348"},{"taxonomy":"header-type","embeddable":true,"href":"https:\/\/grin.co\/wp-json\/wp\/v2\/header-type?post=9348"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}