# An Invitation to Security Researchers

Every company says they take security "very seriously." Rather than bore anyone 
with banal boilerplate, here are some quick answers followed by detailed
elaboration. If you have any questions about our policies, please email them to
`scott@paragonie.com`.

## Quick Answers

* There is no compulsion to disclose vulnerabilities privately, but we 
  appreciate a head's up.
* `security@paragonie.com` will get your reports to the right person. Our GPG 
  fingerprint, should you decide to encrypt your report, is 
  `7F52 D5C6 1D12 55C7 3136  2E82 6B97 A1C2 8264 04DA`.

* **YES**, we will reward security researchers who disclose vulnerabilities in
  our software.
* In most cases, **No Proof-of-Concept Required.**

## How to Report a Security Bug to Paragon Initiative Enterprises

### There is no compulsion to disclose privately.

We believe vulnerability disclosure style is a personal choice and enjoy working
with a diverse community. We understand and appreciate the importance of Full 
Disclosure in the history and practice of security research.

We would *like* to know about high-severity bugs before they become public
knowledge, so we can fix them in a timely manner, but **we do not believe in 
threatening researchers or trying to enforce vulnerability embargoes**.

Ultimately, if you discover a security-affecting vulnerability, what you do with
it is your choice. We would like to work with people, and to celebrate and 
reward their skill, experience, and dedication. We appreciate being informed of
our mistakes so we can learn from them and build a better product. Our goal is
to empower the community.

### Where to Send Security Vulnerabilities

Our security email address is `security@paragonie.com`. Also feel free to open a
new issue on Github if you want to disclose publicly.

```
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG


ha+F/SAEJ0jEquM4TfKWWU2S5V5vgPPpIQSYRnhQW4b1
=xJPW
-----END PGP PUBLIC KEY BLOCK-----
```

### We Will Reward Security Researchers

**This process has not been formalized; nor have dollar amounts been 
discussed.**

However, if you report a valid security-affecting bug, we will compensate you
for the time spent finding the vulnerability and reward you for being a good
neighbor.

#### What does a "valid" bug mean?

There are two sides to this:

1. Some have spammed projects with invalid bug reports hoping to collect
   bounties for pressing a button and running an automated analysis tool. This
   is not cool.
2. There is a potential for the developers of a project to declare all security
   bug reports as invalid to save money.

Our team members have an established history of reporting vulnerabilities to
large open source projects. **We aren't in the business of ripping people off.**
When in doubt, our policy is to err on the side of generosity.

### No Proof-of-Concept Required

We might ask for one if we feel we do not understand some of the details 
pertaining to a specific vulnerability. We certainly appreciate them if you 
include them in your report, but we believe **the burden lies with the developer
to prove their software *is* secure** rather than with the researcher to prove
that it isn't.

In our experience, most bugs are simpler to fix than they are to exploit.

