> It's hard enough to report issues
to OpenAI.
Not at all. OpenAI follows basic accepted standards for security reporting. This is like complaining that you can't find if a website doesn't want specific directories crawled because you don't know about the existence of a robots.txt.
Specifically, OpenAI has a security.txt [0], which is:
> an accepted standard for website security information that allows security researchers to report security vulnerabilities easily [1]
Whenever attempting to find where to report a security issue, the easiest thing to do is always check if the website has a security.txt file.
[0] https://openai.com/security.txt
[1] https://en.wikipedia.org/wiki/Security.txt
Here's their security.txt:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
#
# .d88888b.
# .8P" "9bd888b.
# .8P .d8P" `"988.
# .8888 .d8P" , 98.
# .8P" 88 8" .d98b. 88
# .8P 88 8 .d8P" "98b. 88
# 88 88 8P" `"8b. "98.
# 88. 88 8 8"8b. 88
# 88 "98.8 8 88 "88
# `8b. "98., .d8 88 88
# 88 "98b. .d8P" 8 88 d8"
# 88 "98bP" .8 88 .d8"
# "8b ` .d8P" 8888"
# "88b., .d8P" d8"
# "9888P98b. .d8"
# "988888P"
#
Contact: https://bugcrowd.com/openai
Acknowledgments: https://bugcrowd.com/openai/hall-of-fame
Policy: https://openai.com/policies/coordinated-vulnerability-disclosure-policy
Hiring: https://openai.com/careers/search?c=security
Canonical: https://openai.com/.well-known/security.txt
Encryption: https://cdn.openai.com/security/disclosure.asc.pub
# You may also email us directly.
Contact: mailto:[email protected]
-----BEGIN PGP SIGNATURE-----
iHUEARYKAB0WIQQ5fYPd6Hi19rZDZ+kKj1HZ7OnINQUCZbiKWgAKCRAKj1HZ7OnI
NS9+AQCTx4vlrCp+Urd1fa/lAQ3dcV8VNHOxA4JnxD0TH2nxwQEAuqoxenxPZWeD
+IsSikn4em/LEheOeAakGDzZedcu1QE=
=rMRk
-----END PGP SIGNATURE-----
Not at all. OpenAI follows basic accepted standards for security reporting. This is like complaining that you can't find if a website doesn't want specific directories crawled because you don't know about the existence of a robots.txt.
Specifically, OpenAI has a security.txt [0], which is:
> an accepted standard for website security information that allows security researchers to report security vulnerabilities easily [1]
Whenever attempting to find where to report a security issue, the easiest thing to do is always check if the website has a security.txt file.
[0] https://openai.com/security.txt
[1] https://en.wikipedia.org/wiki/Security.txt
Here's their security.txt: