Coordinated vulnerability disclosure
← Manufofi

Salesforce: Manufar Bayyanawa Cikin Alhaki

A Salesforce, amana ita ce darajarmu ta #1 kuma muna ɗaukar kariyar bayanan abokan cinikinmu da matuƙar muhimmanci.

Ƙungiyar tsaron Salesforce ta amince da muhimmiyar rawar da masu binciken tsaro masu zaman kansu ke takawa a tsaron intanet. Saboda haka, muna ƙarfafa bayar da rahoto cikin alhaki na duk wani rashin tsaro da aka iya samu a shafinmu ko manhajojinmu. Salesforce ta himmatu wajen yin aiki da masu binciken tsaro don tabbatarwa da magance duk wani yiwuwar rashin tsaro da aka bayar da rahotonsa gare mu.

Da fatan za ka karanta waɗannan sharuɗɗa kafin ka gwada da/ko ka bayar da rahoton rashin tsaro. Salesforce ta yi alƙawarin ba za ta fara ɗaukar matakin shari'a a kan masu bincike saboda shiga ko ƙoƙarin shiga tsarukanmu ba muddin suna bin wannan manufa.

Gwajin raunin tsaro:

Duk lokacin da Trial ko Developer Edition ke samuwa, da fatan za ka gudanar da dukkan gwajin rashin tsaro a kan irin waɗannan misalai. Koyaushe yi amfani da asusun gwaji ko na nuni yayin gwada ayyukanmu na kan layi.

Don samun bayani game da kimantawar tsaro, buƙatu, hani, da tsarin lokaci, duba labarin ilimin mai suna "Vulnerability Assessment and Penetration Test".

Bayar da rahoton yiwuwar rashin tsaro:

  • Raba cikakkun bayanan rashin tsaron da ake zargi da Salesforce a asirce ta aika imel zuwa security@salesforce.com
  • Bayar da cikakkun bayanan rashin tsaron da ake zargi domin ƙungiyar tsaron Salesforce ta iya tantancewa da sake haifar da matsalar

Salesforce ba ta yarda da waɗannan nau'ikan binciken tsaro ba:

Duk da cewa muna ƙarfafa ka ka gano ka kuma bayar da rahoton duk wani rashin tsaro da ka samu cikin alhaki, an haramta waɗannan ɗabi'u a bayyane:

  • Aiwatar da ayyukan da za su iya cutar da Salesforce ko masu amfani da ita (misali Spam, Brute Force, Hana Sabis…)
  • Shiga, ko ƙoƙarin shiga, bayanai ko bayani da ba naka ba
  • Lalata ko ɓata, ko ƙoƙarin lalata ko ɓata, bayanai ko bayani da ba naka ba
  • Gudanar da kowane irin hari na zahiri ko na lantarki a kan ma'aikatan Salesforce, kadarori ko cibiyoyin bayanai
  • Yaudarar kowane teburin sabis, ma'aikaci ko ɗan kwangilar Salesforce
  • Gudanar da gwajin rashin tsaro na ayyukan da ke cikin shirin ta amfani da wani abu in ban da asusun gwaji (misali misalan Developer ko Trial Edition)
  • Keta kowace doka ko warware kowace yarjejeniya domin gano raunin tsaro

Alƙawarin ƙungiyar tsaron Salesforce:

Muna roƙonka kada ka raba ko ka yaɗa rashin tsaron da ba a warware ba ga ɓangarori na uku. Idan ka aika rahoton rashin tsaro cikin alhaki, ƙungiyar tsaron Salesforce da ƙungiyoyin ci gaba masu alaƙa za su yi ƙoƙari mai ma'ana don:

  • Amsa cikin lokaci, tare da tabbatar da karɓar rahotonka na rashin tsaro
  • Bayar da kimanin lokacin magance rahoton rashin tsaron
  • Sanar da kai idan an gyara rashin tsaron

Muna farin cikin gode wa kowane mai bincike da ya aika rahoton rashin tsaro wanda ke taimaka mana mu inganta yanayin tsaronmu gaba ɗaya a Salesforce.