CORPORATE THE GROUP SUSTAINABILITY BRANDS WEBSITES NEWS CAREERS CONTACT US VULNERABILITY DISCLOSURE POLICY If you believe you have found a security vulnerability on one of our web sites or in our apps, we thank you in advance for letting us know right away. We will investigate all legitimate reports and do our best to quickly fix any problem. Below you will find the best way to report a security vulnerability, while if you are looking to report a privacy issue, please contact our privacy officer as described on Ferrero Privacy Policy. We will not pursue legal action, nor initiate a complaint to law enforcement, against the finder/researcher operating in good faith. However, the Ferrero Group reserves all legal rights in the event of noncompliance to the Guidelines for Operating in Good Faith that follow. REWARD Ferrero Group does not currently offer a reward program; thus, there will not be any compensation, reward or public recognition for submittal of potential vulnerabilities. GUIDELINES FOR OPERATING IN GOOD FAITH As a proof of good faith, we expect from you an ethical behavior making every effort to: - Avoid disruptive actions against Ferrero systems. - Keep the information related to the discovered vulnerability confidential for a reasonable time period to allow our technical department to resolve the issue. - Avoid privacy violation or any destruction, modification or exfiltration of Ferrero data. - Avoid leveraging the vulnerability in the attempt to reach further systems or services, or to establish persistence (backdoor/command line access). - Not violate any other applicable laws or regulations. OUT OF SCOPE The following vulnerabilities are out of scope for submittal under the Vulnerability Disclosure Policy: - Spam or social engineering techniques. - Denial-of-service attacks. - Brute force credential compromise. - Content injection posting content on Ferrero websites. - Physical access testing (e.g., facility access, tailgating, device theft). CONTACT INFORMATION To disclose a potential vulnerability, please email to: cybersecurity.support@ferrero.com, providing: - Description of the issue - When you found the issue - How it can be reproduced - Any thoughts on how we can mitigate the issue - Feel free to share scripts or network traces If possible, emails in English are preferred. Privacy policy Legal aspects Cookie Policy Technical Requirements Site Map www.ferrerosustainability.com Vulnerability Disclosure Policy copyright © Ferrero 2019 This website uses cookies, belonging to us or to third parties, for performance purposes and serve ads in line with your browsing preferences and that may be of interest to you. To understand more about how we use cookies or to change your cookie preferences, click on “Cookie Settings”. You can change these settings at any time by visiting our cookie policy and following the instructions it contains. By clicking “Accept All Cookies” you agree to the storing of cookies on your device. Cookies Policy Cookies Settings Reject All Cookies Accept All Cookies