Responsible Disclosure
At Maltego, we value the security of our systems and the privacy of our users. We welcome and encourage responsible disclosure of any potential security vulnerabilities found in our systems.
If you believe you have found a security vulnerability in one of our systems or products, we ask that you follow the guidelines below to report it responsibly.
Reporting Process 🔗︎
- Do not attempt to access, modify, or delete other users’ data.
- Do not use the vulnerability for malicious purposes.
- Send us your notification via email to security@maltego.com (You may encrypt to our GPG key (fp: E895 4507 33BA EC10 79AF 35DB 7748 99F2 CDB6 BE42 - https://www.maltego.com/security_maltego.com-pub.asc))
- Please include the following information in your report:
- Your contact details (i.e., name, phone, email address, and PGP key if applicable)
- A description of the vulnerability identified
- The service/device/application impacted by the vulnerability (including hostnames/IPs)
- A step-by-step description of how to recreate the problem
- The source IP address(es) from which the security vulnerability was identified, together with the date, time, and time zone of the discovery (to help us find matching log entries)
- A zip archive containing any files helpful in reproducing the flaw (e.g., screenshots, PoC, code, scripts, pcap traces, logs, source IP addresses, etc.)
Vulnerabilities We Do Not Consider Part of Vulnerability Reporting 🔗︎
- Output of well-known automated tools/scanners
- Social Engineering/Phishing against Maltego employees or partners
- Physical access attacks
- Vulnerabilities in a vendor we integrate with. If you find one, we would like to know about it
- Brute-force / rate-limit / velocity testing
Please allow us reasonable time to investigate and resolve the issue before making any public disclosures.
If you have any questions or concerns, please feel free to contact us at security@maltego.com.
Thank you for helping us keep our systems secure.
