Guidelines for Third Party Disclosure of Vulnerabilities
This document provides guidelines for third parties to disclose or publicize (hereinaftercollectively referred to as "disclose") information about vulnerabilities or behaviors
that they find during testing (hereinafter referred to as " vulnerability information,etc.") regarding products or services provided by Cybozu, Inc. (hereinafter referred toas "Cybozu").
Terms of the Disclosure of Vulnerability Information , etc.
For details on the disclosure of vulnerability information, etc., refer to the Terms ofUse and the Terms and Conditions for Cybozu Bug Bounty Program in addition to thisdocument.
Restrictions and prohibitions described in the Terms of Use
https://www.cybozu.com/jp/terms/Article 5 Handling of Vulnerability Information, etc. in the Terms andConditions for Cybozu Bug Bounty Program
https://cybozu.co.jp/en/company/assets/pdf/terms_en.pdf
Vulnerability Information, etc. That Can Be Disclosed and the Rules ofDisclosure
You can disclose vulnerability information, etc. only when you get approval fromCybozu.
Cybozu examines vulnerability information, etc. to decide whether to approve or rejectthe disclosure, what information can be disclosed and when the information can bedisclosed.
Contact us at the following address if you wish to disclose information:
ContactTokyo Nihombashi Tower 27F, 2-7-1 Nihombashi, Chuo-ku, Tokyo 103-6028 Japan
Cy-PSIRT office, Cybozu, Inc.
productsecurity@cybozu.co.jp

Vulnerability Information, etc. That Are Specific to Cloud Services
For vulnerabilities that are specific to cloud services, you can disclose the informationaccording to the following rules of disclosure after approval by Cybozu.
A vulnerability specific to cloud services means that the vulnerability exists in cloudservices but not in package services.
For example, a feature of a cloud service has a vulnerability and the feature is also
implemented in a package service. In this case, the vulnerability is not specific tocloud services if the package service also has the vulnerability.
Rules of Disclosure◆

For a subdomain of cybozu.com or cybozu-dev.com that is included in e-mailaddresses, server names, web site URLs, and others, use the dummy name"example" as follows.
Example: example.cybozu-dev.com◆For a domain other than cybozu-dev.com or cybozu.com that is included in e-mailaddresses, server names, web site URLs, and others, use a dummy nameaccording to RFC2606 as follows.
Example: example.com◆For IP addresses, use a dummy address according to RFC6890.

◆For personal names, department names, and organization names, use dummy
names (like "User A") or names that are included in the following demo data
provided by Cybozu:
https://onlinedemo2.cybozu.info/scripts/garoon/grn.exe
Personal name: Noboru Sato, Kanna Matsuda, John Doe, etc.
Department name: Information Technology department, etc.
Company name: BOZU, etc.
➢Do not use the real names of individuals, departments, or organizations.

➢Do not use expressions that may stain Cybozu's brand image or that may
suggest the names of specific individuals, departments, or organizations.

◆If screenshots to be disclosed have any expressions that deviate from rules
described above, you must blur out or black out the expressions.

Vulnerability Information, etc. That Are Related To Package Services
For vulnerabilities that are related to package services, you are not allowed to disclose
them. In addition, Cybozu’s prior consent is necessary to disclose information that you
acquire on the course of testing.

Time Required to Fix a Vulnerability in Cybozu Products
We make a continuous effort to improve security quality. However, it may take sometime for us to fix a vulnerability depending on areas to be affected by the fix or theseverity of the vulnerability.
We will not be able to satisfy any requests to accelerate fixing vulnerabilities so thatthe information can be disclosed.
OtherPlease note that these guidelines are subject to change without notice.