Introduction
JetBlue is committed to protecting the security of our systems and our customer's information. To meet our goals, we encourage and support ethical security researchers in reporting vulnerabilities they’ve discovered, in accordance with this Vulnerability Disclosure Policy.
This policy describes what systems and types of research are covered under this policy and how to send us vulnerability reports. By submitting information about a potential vulnerability, you agree to this Policy.
Guidelines
- You must comply with all applicable laws while carrying out your research.
- Inform us as soon as possible, upon discovery of a potential security vulnerability. We will prioritize and remediate the reported vulnerability at our sole discretion.
- Do not submit a high volume of low quality reports obtained by the use of automated scanning tools.
- Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
- Only use exploits to the extent necessary to confirm a vulnerability. Do not use an exploit to compromise or extract data, establish command line access and/or persistence, or use the exploit to “pivot” to other systems. Once you’ve established that a vulnerability exists, or encountered any of the sensitive data outlined below, you must stop your test and notify us immediately.
- Keep confidential any information about discovered vulnerabilities.
Scope
This policy applies to the following systems:
- www.jetblue.com and the following subdomains: book.jetblue.com, checkin.jetblue.com, mobile.jetblue.com, movil.jetblue.com, api.jetblue.com, accounts.jetblue.com, help.jetblue.com, azrest.jetblue.com, magnolia.jetblue.com, experience.jetblue.com
- Any other subdomains of jetblue.com and all business partner applications are excluded from this policy.
Any services not expressly listed above, such as any connected services, are excluded from scope and are not authorized for testing. Additionally, vulnerabilities found in JetBlue systems from our business partners fall outside of this policy’s scope and should be reported directly to the business partner according to their disclosure policy (if any).
The following test types are not authorized:
- Network denial of service (DoS or DDoS) tests.
- Physical security compromises
- Social Engineering
- Spamming and Phishing
If you encounter any of the below on our systems while testing within the scope of this policy, stop your testing and report it to the program immediately:
- Personally identifiable information
- Financial information (e.g. credit card or bank account numbers)
- Proprietary information or trade secrets of companies of any party
- Any other data that is not intentionally shared over public filings, web pages etc.
Authorization
If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, and will work with you to understand and resolve the issue quickly.
Reporting a Vulnerability
We accept and discuss vulnerability reports on HackerOne. Reports may be submitted anonymously. Note: For particularly sensitive information, only submit through our HackerOne program.
Reports should include:
- Description of the location and potential impact of the vulnerability.
- A detailed description of the steps required to reproduce the vulnerability. Proof of concept (POC) scripts, screenshots, and screen captures are all helpful. Please use extreme care to properly label and protect any exploit code.
- Any technical information and related materials we would need to reproduce the issue.
Please keep your vulnerability reports current by updating your report with any new information as it becomes available. We may share your vulnerability reports with any affected business partners.
Coordinated Disclosure
At JetBlue, we believe that public disclosure of vulnerabilities is an essential part of the vulnerability disclosure process, and that one of the best ways to make software better is to enable everyone to learn from each other’s mistakes.
At the same time, we believe that disclosure in absence of a readily available patch tends to increase risk rather than reduce it, and so we ask that you refrain from sharing your report with others while we work on our patch. If you believe there are others that should be informed of your report before the patch is available, please let us know so we can make arrangements.
We may want to coordinate an advisory with you to be published simultaneously with the patch, but you are also welcome to self-disclose if you prefer. By default, we prefer to disclose everything, but we will never publish information about you or our communications with you without your permission. In some cases, we may also have some sensitive information that should be redacted, and so please check with us before self-disclosing.