Chương trình Săn lỗi Bảo mật

Các bản báo cáo chất lượng đủ điều kiện nhận phần thưởng lên tới 5.000 USD.*

The following domains (including sub-domains) are in scope:

*.synology.com

The following domains (including sub-domains) are out of scope:

openstack-ci-logs.synology.com, router.synology.com, order.synology.com

Synology reserves the right to modify this list at any time without notice.

This program is strictly limited to security vulnerabilities found in Synology products and services. Actions that could potentially damage or detrimentally affect Synology servers or data are strictly forbidden. Vulnerability testing must not breach local or Taiwanese laws.

Vulnerability reports are not accepted under the program if they describe or involve:

1. DoS (Denial of Service) attacks on Synology’s or users' servers
2. Vulnerability testing that is detrimental to Synology’s or users’ servers or data
3. Physical attacks or social engineering
4. Disclosure of bug information before approval by Synology
5. Directory traversal on https://*archive.synology.com
6. Reflected file download
7. Banner grabbing issues or software version disclosure
8. 0-day vulnerability disclosed within 90 days
9. Non-critical vulnerabilities in outdated services or products
10. Vulnerabilities affecting only outdated web browsers
11. Most types of brute-force attack
12. Reflected XSS attacks or Self XSS attacks
13. Vulnerabilities that involve phishing, creation of fake websites, or committing fraud
14. Vulnerability scanning reports that do not detail the vulnerability’s effects
15. Indications that default ports are vulnerable, but without providing a PoC