Skip to content
HCF
HCF

Responsible disclosure

Report a vulnerability

If you believe you have found a vulnerability in an HCF or FortiFind product or website, we want to hear about it.
Open the contact form

The process

Disclosure in four steps

  1. 1ReportUse the contact form and choose Vulnerability disclosure. No exploit code in a first message.
  2. 2AcknowledgeHCF reads every report and replies as soon as it can.
  3. 3FixValid reports are worked on, and you are kept informed of progress.
  4. 4DiscloseAfter a reasonable time to fix, an advisory is published, with credit if you want it.

What to include

  • The product or web address affected, and its version if known.
  • A description of the issue and its potential impact.
  • The steps needed to reproduce it.
  • How you would like to be credited, if at all.

Do not include exploit code, credentials or other sensitive data in a first message. We will arrange a safe way to share details if needed.

Guidelines

  • Only test systems you own, or HCF and FortiFind systems within these guidelines.
  • Do not access, change or delete data that does not belong to you.
  • Do not degrade service for others: no denial-of-service, spam or social engineering.
  • Give us reasonable time to fix an issue before disclosing it publicly.

What we commit to

  • We read every report and respond as soon as we can.
  • We keep you informed of progress on valid reports.
  • We will not pursue action against good-faith research that follows these guidelines.

HCF does not run a bug bounty program and does not pay for reports. A dedicated security email address will be published here when it exists; until then, use the contact form.