Skip to contentAuthority and scope
- Who can approve the program and its commitments?
- Which domains, applications, APIs, products, and versions are covered?
- Which services are excluded, and why?
- Which supplier permissions or contracts need review?
- Who updates scope when services change?
Research conditions
- Which methods and account types are permitted?
- Which disruptive or sensitive activities are excluded?
- What should a researcher do after unexpected access to sensitive information?
- How can a researcher ask about an unclear boundary before testing?
- Who reviews authorization and safe-harbor language?
- Which commitments are outside the organization's authority?
Report intake
- What is the actual reporting channel?
- Who monitors it, including during absence?
- How can sensitive evidence be transmitted?
- Which minimum fields make a report investigable?
- How are attachments isolated and reviewed?
- Who can access reports, and how long are they retained?
- When was the reporting route last tested end to end?
Triage and repair
- Who acknowledges receipt?
- Who verifies scope and reproduces behavior?
- Who assigns the affected service owner?
- Which conditions trigger incident response?
- How are duplicates, rejected claims, and new evidence handled?
- What proves the fix works?
- Who can accept risk, with which review date?
Communication and disclosure
- What acknowledgement and update commitments can staffing support?
- Who communicates with the reporter?
- How will delays and unresolved questions be explained?
- Which suppliers, customers, or coordinators may need to participate?
- Who decides on advisories, timing, and researcher credit?
- How are decisions and earlier policy versions preserved?
Publication and maintenance
- Where will the final approved policy be published?
- Who maintains contact information and any security.txt expiry?
- Which cases will be sampled to check closure quality?
- Who owns the next program review, and when is it due?