²ÝÁñÉçÇø

Cybersecurity is most successful when it is built into the development and delivery of products, applications, and platforms. We also recognize that there is no silver bullet solution to security and welcome contributions from external security researchers, industry organizations, vendors, and other sources concerned with cybersecurity.

Responsible Disclosure Guidelines

To promote the discovery and reporting of vulnerabilities in our products, and to ensure safety for users of our products, reporters must adhere to the following guidelines for submission of any potential vulnerabilities: 

• Share security issues with ²ÝÁñÉçÇø confidentially, with sufficient information to evaluate the submission (recommended details below)
  
• Do not make any information public without ²ÝÁñÉçÇø¡¯ guidance and consent 
  
• Do not access or modify any user data in any application (regardless of whether that data belongs to ²ÝÁñÉçÇø or an end user of the application). Only interact with your own accounts or test accounts for security research purposes
  
• Contact ²ÝÁñÉçÇø within 24 hours if you encounter any end user data. Do not view, alter, save, store, transfer, or otherwise access the data, and immediately purge any local information upon reporting the vulnerability to ²ÝÁñÉçÇø 
  
• Always act in good faith so as to avoid violations to applicable laws, the destruction of data, or the interruption or degradation of our services (including denial of service)
  
• Comply with all applicable laws 
  

We will not negotiate in response to duress or threats. We will not negotiate under threat of withholding the vulnerability or threat of releasing the vulnerability or any exposed data to the public.

Reporting a Potential Security Vulnerability 

If you observe a potential security vulnerability in one of our products, you are strongly encouraged to contact ²ÝÁñÉçÇø to report it and include the following details when reporting a potential security vulnerability:

• Affected Product/Platform and Version 
  
• Technical description of the issue 
• Detailed steps to reproduce and/or sample code used to exploit the vulnerability 
  
• Contact information and optional name for acknowledgments
  
• Proposed disclosure plans 

Excluded Submission Types

• Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks 
  
• Findings generated by automated tools without detailed explanation on what parts are vulnerable and how the vulnerability might be exploited
  

²ÝÁñÉçÇø prefers all reports of potential security vulnerabilities for ²ÝÁñÉçÇø products or software are encrypted using the PGP/GNU Privacy Guard (GPG) public key found below. Please report any potential security vulnerabilities in ²ÝÁñÉçÇø products or software to the following email address: psirt@synopsys.com.

PGP Key File: public_key.asc 

PGP Key Fingerprint: A372 BE54 6549 A2D5 D26E DB81 4E5B E854 E9B9 A073 

 Please note that the PSIRT contact addresses should only be used for reporting undisclosed security vulnerabilities in our products, applications, and platforms, and for managing the process of fixing such vulnerabilities. If you¡¯d like to make a general support request, please use the official support channel. All mail sent to this address that does not relate to an undisclosed security vulnerability will be destroyed.

Consequences of Complying with Policy 

We consider that activities consistent with this policy are ¡°authorized¡± conduct under the Computer Fraud and Abuse Act.?If legal action is initiated by a third party against you and you have complied with ²ÝÁñÉçÇø¡¯ Vulnerability Disclosure policy, ²ÝÁñÉçÇø will make it known that your actions were conducted in compliance with this policy.

²ÝÁñÉçÇø Vulnerability Disclosure Process Overview 

The ²ÝÁñÉçÇø Vulnerability Disclosure Process is executed by the Product Security Incident Response Team (PSIRT). The ²ÝÁñÉçÇø process is based on well-known industry standards, such as NIST-SP-800-61, ISO 29147, and ISO 30111. 

The ²ÝÁñÉçÇø PSIRT coordinates the response and, if necessary, disclosure of security incidents related to ²ÝÁñÉçÇø products and associated software. ²ÝÁñÉçÇø PSIRT's primary objective is to minimize the risks associated with security incidents in a timely, secure, and responsible manner.