Arup
Top 100K siteVDPActivePartial Safe Harbor
Program Details
Arup takes vulnerability reports by email on the internet-facing systems and services it owns or operates. There's no bug bounty and reports aren't paid. A report needs a reproducible proof of concept, an explanation of the risk and impact, and evidence the issue is in scope, and scanner output on its own isn't accepted. Arup aims to acknowledge within five business days and update within 20, and doesn't intend to take action against researchers who act in good faith and follow the statement.
- Allows Disclosure
- Yes
- Response SLA
- 5 business days
Rules & Testing
Excluded Methods
DosSocial EngineeringPhishingPhysical AccessAutomated ScanningBrute Force
Scope (1 targets)
- Publicly accessible, internet-facing systems and services owned or operated by Arup other
Out of Scope
Client systems, Third-party platforms not controlled by Arup, Reports that rely only on automated scanner output
Security
- PGP Key
- https://vulnerability.cyber.arup.com/Vulnerability-arup-public-key.txt
- Preferred Languages
- English
security.txt
- Contact
- mailto:[email protected]
- Encryption
- https://vulnerability.cyber.arup.com/Vulnerability-arup-public-key.txt
- Policy
- https://vulnerability.cyber.arup.com/Vulnerability-Disclosure-Policy.pdf
- Languages
- en
- Expires
- Aug 28, 2030