You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* "[Architecture and Reference Framework](docs/architecture-and-reference-framework-main.md)"
93
+
the main narrative text that describes the European Digital Identity Wallet and
94
+
its ecosystem.
95
+
* "[Annexes](docs/annexes/README.md)" the list of annexes that provide additional
96
+
information to the main narrative text. In particular, the annexes provide normative
97
+
high-level requirements.
98
+
* "[Technical Specifications](docs/technical-specifications/README.md)" the list
99
+
of specifications that will be developed to support the implementation of the
100
+
European Digital Identity Wallet.
101
+
* "[Discussion Topics](docs/discussion-topics/README.md)" the list of discussion
102
+
topics that are open for public consultation. The topics are organized into
103
+
three iterations, each focusing on a specific set of subjects to be included in
104
+
a major document release.
105
+
106
+
The latest **authoritative version** is tagged as [release/tag in this repository](https://github.com/eu-digital-identity-wallet/architecture-and-reference-framework/releases).
62
107
63
108
## Contributing
64
109
@@ -72,16 +117,16 @@ see the [tags on this repository](https://github.com/eu-digital-identity-wallet/
72
117
73
118
## Authors
74
119
75
-
See the list of [contributors](https://github.com/eu-digital-identity-wallet/architecture-and-reference-framework/graphs/contributors) who participated in this project.
120
+
See the list of [contributors](https://github.com/eu-digital-identity-wallet/architecture-and-reference-framework/graphs/contributors)
121
+
who participated in this project.
76
122
77
123
## License
78
124
79
-
This project is licensed under the [Attribution 4.0
80
-
International](http://creativecommons.org/licenses/by/4.0/) - see the
81
-
[LICENSE.txt](LICENSE) file for details.
125
+
This project is licensed under the [Attribution 4.0 International](http://creativecommons.org/licenses/by/4.0/)
*[Contact the European Commission](https://commission.europa.eu/about-european-commission/contact_en)
86
131
*[Follow the European Commission on social media](https://european-union.europa.eu/contact-eu/social-media-channels_en#/search?page=0&institutions=european_commission)
87
-
*[Resources for partners](https://commission.europa.eu/resources-partners_en)
132
+
*[Resources for partners](https://commission.europa.eu/resources-partners_en)
# EU Digital Identity Wallet Vulnerability Disclosure Policy (VDP)
2
2
3
-
At the European Commission, we treat the security of our Communication and Information Systems as a top priority, in line with Commission Decision EC 2017/46. However, vulnerabilities can never be completely eliminated, despite all efforts. If exploited, such vulnerabilities can harm the confidentiality, integrity or availability of the Commission's systems and of the information processed therein. To identify and remediate vulnerabilities as soon as possible, we value the input of external entities acting in good faith, and we encourage responsible vulnerability research and disclosure. This document sets out our definition of good faith in the context of finding and reporting vulnerabilities, as well as what you can expect from us in return.
3
+
At the European Commission, we treat the security of our Communication and
4
+
Information Systems as a top priority, in line with Commission Decision EC
5
+
2017/46. However, vulnerabilities can never be completely eliminated, despite
6
+
all efforts. If exploited, such vulnerabilities can harm the confidentiality,
7
+
integrity or availability of the Commission's systems and of the information
8
+
processed therein. To identify and remediate vulnerabilities as soon as
9
+
possible, we value the input of external entities acting in good faith, and we
10
+
encourage responsible vulnerability research and disclosure. This document sets
11
+
out our definition of good faith in the context of finding and reporting
12
+
vulnerabilities, as well as what you can expect from us in return.
4
13
5
14
## Scope
6
15
@@ -9,34 +18,50 @@ At the European Commission, we treat the security of our Communication and Infor
9
18
10
19
## If you have identified a vulnerability, please do the following
11
20
12
-
- E-mail your findings to <[email protected]>, specifying whether or not you agree to your name or pseudonym being made publicly available as the discoverer of the problem.
13
-
- Encrypt your findings using our [PGP key](https://ec.europa.eu/assets/digit/pgpkey/ec-vulnerability-disclosure-pgp.txt) to prevent this critical information from falling into the wrong hands.
14
-
- Provide us with sufficient information to reproduce the problem so that we can resolve it as quickly as possible. Usually, the IP address or the URL of the affected system and a description of the vulnerability will be sufficient, but complex vulnerabilities may require further explanation in terms of technical information or potential proof-of-concept code.
15
-
- Provide your report in English, preferably, or in any other official language of the European Union.
16
-
- Inform us if you agree to make your name/pseudonym publicly available as the discoverer of the vulnerability.
whether or not you agree to your name or pseudonym being made publicly available
23
+
as the discoverer of the problem.
24
+
- Encrypt your findings using our [PGP key](https://ec.europa.eu/assets/digit/pgpkey/ec-vulnerability-disclosure-pgp.txt)
25
+
to prevent this critical information from falling into the wrong hands.
26
+
- Provide us with sufficient information to reproduce the problem so that we can
27
+
resolve it as quickly as possible. Usually, the IP address or the URL of the
28
+
affected system and a description of the vulnerability will be sufficient, but
29
+
complex vulnerabilities may require further explanation in terms of technical
30
+
information or potential proof-of-concept code.
31
+
- Provide your report in English, preferably, or in any other official language
32
+
of the European Union.
33
+
- Inform us if you agree to make your name/pseudonym publicly available as the
34
+
discoverer of the vulnerability.
17
35
18
36
## Please do not do the following
19
37
20
-
- Do not take advantage of the vulnerability or problem you have discovered, for example, by downloading more data than necessary to demonstrate the vulnerability, deleting, or modifying other people’s data.
38
+
- Do not take advantage of the vulnerability or problem you have discovered, for
39
+
example, by downloading more data than necessary to demonstrate the
40
+
vulnerability, deleting, or modifying other people’s data.
21
41
- Do not reveal any data downloaded during the discovery to any other parties.
22
42
- Do not reveal the problem to others until it has been resolved.
23
43
- Do not perform the following actions:
24
-
- Placing malware (virus, worm, Trojan horse, etc.) within the system.
25
-
- Reading, copying, modifying or deleting data from the system.
26
-
- Making changes to the system.
27
-
- Repeatedly accessing the system or sharing access with others.
28
-
- Using any access obtained to attempt to access other systems.
29
-
- Changing access rights for any other users.
30
-
- Using automated scanning tools.
31
-
- Using the so-called "brute force" of access to the system.
32
-
- Using denial-of-service or social engineering (phishing, vishing, spam, etc.).
44
+
- Placing malware (virus, worm, Trojan horse, etc.) within the system.
45
+
- Reading, copying, modifying or deleting data from the system.
46
+
- Making changes to the system.
47
+
- Repeatedly accessing the system or sharing access with others.
48
+
- Using any access obtained to attempt to access other systems.
49
+
- Changing access rights for any other users.
50
+
- Using automated scanning tools.
51
+
- Using the so-called "brute force" of access to the system.
52
+
- Using denial-of-service or social engineering (phishing, vishing, spam, etc.).
33
53
- Do not use attacks on physical security.
34
54
35
55
## What we promise
36
56
37
-
- We will respond to your report within three business days with our evaluation of the report.
38
-
57
+
- We will respond to your report within three business days with our evaluation
58
+
of the report.
39
59
- We will handle your report with strict confidentiality.
40
60
- Where possible, we will inform you when the vulnerability has been remedied.
41
-
- We will process the personal data that you provide (such as your e-mail address and name) in accordance with the applicable data protection legislation and will not pass on your personal details to third parties without your permission.
42
-
- In the public information concerning the problem reported, we will publish your name as the discoverer of the problem if you have agreed to this in your initial e-mail
61
+
- We will process the personal data that you provide (such as your e-mail
62
+
address and name) in accordance with the applicable data protection legislation
63
+
and will not pass on your personal details to third parties without your
64
+
permission.
65
+
- In the public information concerning the problem reported, we will publish
66
+
your name as the discoverer of the problem if you have agreed to this in your
0 commit comments