Responsible Disclosure Policy
Equinor protects information created by us, or given to us, to ensure appropriate confidentiality and integrity. Therefore, the security of our information systems is of paramount importance to us.
If you discover a vulnerability in one of our systems, we would like to know about it so that we can address it as quickly as possible.
Please do the following:
- Email your findings to firstname.lastname@example.org. Encrypt your findings using our PGP key (see below) to prevent the information from falling into the wrong hands
- Include enough information for us to reproduce the problem
- Do not take advantage of the vulnerability, for example by downloading more data than is necessary to demonstrate the vulnerability or making changes to the information system
- Do not reveal the vulnerability to others until it has been resolved
Equinor’s Computer Incident Response Team will review your submission. If the vulnerability is valid, mitigation will be performed in accordance with the company’s internal procedures. You will be notified when the problem has been resolved.
We will not take legal action towards those who discover and report security vulnerabilities in accordance with this Responsible Disclosure Policy.
Any person’s private information will be treated according to Privacy and Data Protection in Equinor.