Vulnerability Report
Introduction
Scope
This program is not intended for submitting complaints about Anyone Home’s services or products, or for inquiries regarding the availability of company web sites or online services.
The following types of vulnerabilities are out of the scope for this program:
- Volumetric vulnerabilities (e.g., Denial of Service or Distributed DoS);
- Reports of non-exploitable vulnerabilities and violation of “best practices” (e.g. missing security headers);
- Transport Layer Security (TLS) configuration weaknesses (e.g., support for “weak” cipher suites);
- Fingerprinting/banner disclosure on common/public services;
- Self-cross-site scripting (XSS);
- Internal IP disclosure;
- Cross-site request forgery (CSRF);
- Un-exploitable HTTP Methods (e.g., OPTIONS or HEAD);
- Error-messages with non-sensitive data; and
- Lack of secure/HTTP-only flags on non-session cookies.
Anyone Home may at any time update this policy, including the foregoing list of out-of-scope vulnerabilities.
Reporting a Vulnerability
If you have discovered an issue that you believe is an in-scope vulnerability, please email vulnerability@anyonehome.com. Please include the following, as applicable:
- A detailed description of the vulnerability
- The full URL
- A Proof of Concept (POC) or instructions (e.g. screen shots, video, etc.) on how to reproduce the vulnerability or steps taken
- Entry fields, filters, or other objects involved
- Risk or exportability assessment
- Instructions for how to reach you with follow up questions
Offering a solution is encouraged but not required. Lack of detailed vulnerability explanation may result in delays in our response and subsequent potential actions on the finding.
Bug Bounties
What to Expect
Public Notification
Guidance
This policy prohibits the performance of the following activities:
- Hack, penetrate, or otherwise attempt to gain unauthorized access to Anyone Home’s software or systems;
- Active vulnerability scanning or testing;
- Disclose or use any proprietary or confidential Anyone Home information or data, including customer data; or
- Adversely affect the operation of Anyone Home software or systems.
Security researchers must not violate any law, or access, use, alter or compromise in any manner any Anyone Home data.
If you have any questions regarding this policy or the guidance above, please contact our security team for guidance: vulnerability@anyonehome.com.
Policy Definitions
Vulnerability: A weakness in the design, implementation, operation or internal control of a process that could expose the system to adverse threats from threat events.
Denial of Service (DoS): An attack on a service from a single source that floods it with so many requests that it becomes overwhelmed and is either stopped completely or operates at a significantly reduced rate.
Distributed Denial of Service (DDoS): An attack on a service from multiple compromised computer systems that floods it with so many requests that it becomes overwhelmed and is either stopped completely or operates at a significantly reduced rate, thereby denying service to legitimate users or systems.
Transport Layer Security (TLS): A protocol that provides communications privacy over the Internet. The protocol allows client/server applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery.
Self-Cross-Site Scripting (XCSS): A social engineering attack to gain control of a victim’s web accounts via the victim unknowingly running malicious code on their own web browser.
Cross-Site Request Forgery (CSRF): A type of malicious exploit of a web site where unauthorized commands are transmitted from a user that the web site trusts. This is also known as a one-click attack or session riding.