Responsible Disclosure Policy

At Synopsys, we take security issues very seriously and recognize the importance of privacy, security, and community outreach. Our mission is to work with third parties (including our customers, the open source community, and others) to improve the security and quality of the software that powers their business functions. 

This policy sets forth the reporting and disclosure process that Software Integrity Group (SIG) follow when we discover security vulnerabilities in non-SIG products and services. If a vulnerability is found in a vendor’s product or service, SIG will attempt to contact the vendor by email to notify the vendor of such discovery. SIG will initially attempt to create a secure communication channel with the vendor by exchanging PGP keys for encrypted email. If a secure communication channel is successfully created, then an encrypted copy of the vulnerability report will be sent to the vendor through that channel. If no response to the attempt to create a secure communication channel is received by SIG within seven (7) days, then a description of the vulnerability will be sent by email to the vendor in plain text. 

Our approach to vulnerability disclosure is based on industry standards and the Carnegie Mellon University Computer Emergency Response Team (CERT) vulnerability policy. For additional information, see the CERT disclosure guidelines

If SIG discovers a vulnerability in a vendor’s product or service, it will take the following steps:

Actions take by SIG

Day 0
  • Initial Vendor contact
  • Assignment of CVE (Common Vulnerabilities and Exposures) if vendor is not a CNA (CVE Numbering Authority)
  • Protections released to SIG customers for SIG products
Day 7
  • Second vendor contact, if there is no response to SIG's initial communication
Day 45
  • Reminder email sent to the vendor with the release date of the vulnerability report
Day 60
  • If the vendor has not responded or has stopped responding, a final reminder email will be sent
Day 90
  • Disclosure of the full vulnerability report on the SIG Cyber security Research Center (CyRC) blog; however, if the vendor releases a patch or mitigation for the vulnerability before the 90th day, then SIG will disclose the full vulnerability report immediately following vendor’s release of such patch or mitigation
  • CVE publication request submitted to Mitre

In the interest of fostering coordinated vulnerability disclosure, SIG will attempt to work with any vendor on reasonable adjustments to the above timeline if progress is being made and the 90-day default timeline is not adequate for creating a patch or other type of mitigation that addresses the vulnerability. Extenuating circumstances may result in adjustments to the disclosures and timelines when reasonably necessary. 

Disclosure of Security Vulnerabilities Discovered as Part of Software Integrity Group (SIG) Consulting Services Delivery 

If a new or previously undisclosed security vulnerability is found during a SIG Consulting Services engagement with a customer, SIG will follow the SIG Product Security Incident Response Process. Vulnerabilities found in SIG products will be handled by the SIG PSIRT according to SIG's Security Vulnerability Policy. If the vulnerability is in another vendor’s product, SIG will follow the SIG Responsible Disclosure Policy unless the affected customer wishes to report the vulnerability to the vendor directly; in that case, SIG will facilitate contact between the customer and the vendor, and will notify CERT /CC (or its national equivalent). 

SIG will protect customer-specific data at all times throughout this process. Specifically, SIG will not share any customer-specific data unless directed to do so by the affected customer, or as required by a legal investigation. 

Contact Information 

Email address: disclosure@synopsys.com

Public PGP Key