# Security Vulnerability Reporting Process
 
## Introduction
 
At Guardian Life Insurance, we prioritize the security and privacy of our users. We recognize the valuable role that security researchers and the wider community play in identifying vulnerabilities and ensuring the safety of our systems. This document outlines our process for responsible disclosure of security vulnerabilities.
 
## Reporting a Vulnerability
 
If you believe you have found a security vulnerability in our systems or products, we encourage you to notify us promptly. We welcome reports from everyone, including security researchers, industry partners, vendors, and customers.
 
### How to Report
 
- **Email**: Please send your report to our security team at [tech_inquiries@glic.com](mailto:tech_inquiries@glic.com).
- **GPG Key**: To protect the confidentiality of your report, you may use our GPG key. You can find our public GPG key at [ https://www.guardianlife.com/.well-known/security.txt]( https://www.guardianlife.com/.well-known/security.txt).
 
### Information to Include
 
When reporting a vulnerability, please include the following information:
 
- A detailed description of the vulnerability.
- Steps to reproduce the issue.
- Potential impact and severity of the vulnerability.
- Any proof-of-concept code, screenshots, or videos that illustrate the issue.
- Your contact information (name, email address, and GPG key if applicable).
 
### Security.txt
 
You can find our `security.txt` file at [https://www.guardianlife.com/.well-known/security.txt](https://www.guardianlife.com/.well-known/security.txt). This file contains our security contact information and other relevant details for reporting vulnerabilities.
 
## Our Commitment
 
Upon receiving your report, we commit to:
 
- Acknowledging receipt of your vulnerability report within 5 business days.
- Our team will engage further with you as needed to address the reported issue. 
- All reports will be reviewed and prioritized based on severity and impact.
 
## Safe Harbor
 
To encourage responsible disclosure, we agree to the following:
 
- We will not pursue legal action against individuals who report vulnerabilities to us in accordance with this process.
- We will not terminate or suspend access to our services for individuals who report vulnerabilities responsibly.
- We will work with security researchers to understand and resolve reported issues, including acknowledging their contributions publicly if mutually agreed.
 
## Scope
 
This process applies to vulnerabilities in:
 
- Web applications owned and operated by Guardian Life Insurance Company of America.
- Mobile applications developed by Guardian Life Insurance Company of America.
- Any other systems or services provided by Guardian Life Insurance Company of America.
 
## Exclusions
 
While we encourage reports of any security vulnerabilities, the following are generally not within the scope of our responsible disclosure program:
 
- Issues related to out-of-date browsers or plugins.
- Denial of Service (DoS) attacks.
- Social engineering of our employees or contractors.
- Physical attacks on our infrastructure.
 
 
## Conclusion
 
We appreciate the efforts of the security community in helping us keep our systems secure. Your assistance is invaluable, and we look forward to working with you to maintain the security and privacy of our users.
 
If you have any questions about this process, please contact our security team at [ tech_inquiries@glic.com](mailto: tech_inquiries@glic.com).