From 212a1bd0f0612ac0bd214a23854d959491748e3a Mon Sep 17 00:00:00 2001 From: natalialuzuriaga Date: Fri, 16 Aug 2024 15:20:09 +0000 Subject: [PATCH] chore: adding files --- SECURITY.md | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 0230f3c..07342ef 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,18 +2,11 @@ The Centers for Medicare & Medicaid Services is committed to ensuring the security of the American public by protecting their information from unwarranted disclosure. We want security researchers to feel comfortable reporting vulnerabilities they have discovered so we can fix them and keep our users safe. We developed our disclosure policy to reflect our values and uphold our sense of responsibility to security researchers who share their expertise with us in good faith. -*Submit a vulnerability:* Unfortunately, we cannot accept secure submissions via -email or via GitHub Issues. Please use our website to submit vulnerabilities at -[https://hhs.responsibledisclosure.com](https://hhs.responsibledisclosure.com). -HHS maintains an acknowledgements page to recognize your efforts on behalf of -the American public, but you are also welcome to submit anonymously. +*Submit a vulnerability:* Vulnerability reports can be submitted through [Bugcrowd](https://bugcrowd.com/cms-vdp). Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 3 business days. Review the HHS Disclosure Policy and websites in scope: [https://www.hhs.gov/vulnerability-disclosure-policy/index.html](https://www.hhs.gov/vulnerability-disclosure-policy/index.html). This policy describes *what systems and types of research* are covered under this policy, *how to send* us vulnerability reports, and *how long* we ask security -researchers to wait before publicly disclosing vulnerabilities. - -If you have other cybersecurity related questions, please contact us at -[csirc@hhs.gov](mailto:csirc@hhs.gov). \ No newline at end of file +researchers to wait before publicly disclosing vulnerabilities. \ No newline at end of file