Vulnerability Disclosure Policy

dGB Earth Sciences is committed to the security and integrity of OpendTect and related products and components. We recognize the vital role the security research community plays in helping us identify and mitigate potential vulnerabilities. This policy outlines our commitment to receiving, reviewing, and addressing vulnerability reports from external parties. dGB handles vulnerability reports in accordance with applicable legal and regulatory cybersecurity requirements.

This policy applies to the following products managed by dGB Earth Sciences:

• OpendTect (Community)
• OpendTect Pro
• Commercial Plugins

For third-party plugins distributed through the OpendTect Installer or OpendTect Pro Store, dGB Earth Sciences acts as a point of contact and will facilitate coordination of reported vulnerabilities with the relevant third-party developer or provider where appropriate.

If you believe you have discovered a security vulnerability in a product or component covered by this policy, we encourage you to report it to us as soon as possible.

Reporting Channel: Please submit your report to security@dgbes.com.

Preferred Language: Please submit vulnerability reports in English where possible. Reports in Dutch or French are also accepted.

What to Include: To ensure efficient triage, please provide:

• The date the vulnerability was discovered
• A clear description of the vulnerability (type, potential impact).
• The product name and specific version affected.
• Steps to reproduce the vulnerability (including any code, data, or environment details).
• Any proof-of-concept or supporting evidence
• Whether the vulnerability is believed to have been exploited
• Whether you have already disclosed the vulnerability to any other party. If so, please provide the relevant contact information.
• Your contact information for follow-up communication.

Upon receiving a report, dGB Earth Sciences commits to the following:

• Acknowledgement: We aim to acknowledge receipt of vulnerability reports within two business days.
• Investigation: We will investigate the reported issue in a timely manner, prioritizing based on severity and risk.
• Resolution: We will work to address the vulnerability through an appropriate patch or mitigation, or coordinate with the responsible third-party developer or provider where applicable.
• Communication: We will provide updates on the progress of your report and notify you once the issue has been addressed or if we determine the report does not constitute a security vulnerability.
• Timelines: While we strive for timely updates, resolution timelines depend on vulnerability complexity and, where applicable, coordination with third-party developers or providers.

The following testing activities are prohibited under this policy:

• Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks.
• Social engineering of dGB employees or customers, or third parties.
• Automated scans that degrade system or service performance.
• Accessing, modifying, deleting, downloading, or retaining data beyond what is reasonably necessary to demonstrate a vulnerability.
• Intentionally disrupting or degrading dGB, customer, or third-party systems or services.
• Installing malware, establishing persistence, or maintaining unauthorized access to a system after demonstrating the vulnerability.
• Security testing against third-party systems or services that are not operated by dGB without authorization from the relevant third party.

We encourage responsible security research and coordinated disclosure. Provided that your research is conducted in good faith and complies with this policy, dGB Earth Sciences will not initiate legal action against you. We explicitly require adherence to the following "Safe Harbor" guidelines:

• Data Integrity: Do not access, modify, delete, or retain data beyond the minimum necessary to demonstrate the identified vulnerability.
• Privacy Protection: Avoid any action that could intentionally compromise the privacy of other users.
• Exploitation Minimization: Refrain from exploiting any identified vulnerability beyond what is strictly necessary to demonstrate its existence.
• Coordination & Disclosure: Do not publicly disclose vulnerability details before coordinating disclosure with dGB Earth Sciences and allowing us a reasonable opportunity to address the issue.
• Sensitive Data Protocol: If sensitive or personal data is encountered, cease testing immediately and notify dGB Earth Sciences.