Responsible Disclosure Policy
At Synopsys, we take security issues very seriously and recognize the importance of privacy, security, and community outreach. Our mission is to work with third parties (including our customers, the open source community, and others) to improve the security and quality of the software that powers their business functions.
This policy sets forth the reporting and disclosure process that Software Integrity Group (SIG) follow when we discover security vulnerabilities in non-SIG products and services. If a vulnerability is found in a vendor’s product or service, SIG will attempt to contact the vendor by email to notify the vendor of such discovery. SIG will initially attempt to create a secure communication channel with the vendor by exchanging PGP keys for encrypted email. If a secure communication channel is successfully created, then an encrypted copy of the vulnerability report will be sent to the vendor through that channel. If no response to the attempt to create a secure communication channel is received by SIG within seven (7) days, then a description of the vulnerability will be sent by email to the vendor in plain text.
Our approach to vulnerability disclosure is based on industry standards and the Carnegie Mellon University Computer Emergency Response Team (CERT) vulnerability policy. For additional information, see the CERT disclosure guidelines.
If SIG discovers a vulnerability in a vendor’s product or service, it will take the following steps: