AWS Attribution for security vulnerabilities

[aws]

AWS Attribution for security vulnerabilities

[annamataws]

Hi,

AWS has many testing methodologies for our production services. Currently AWS does not have a public bug bounty as a part of that suite of methodologies. If an issue with AWS is discovered in production, please submit that issue to our security team using the instructions available on the Security Vulnerability Reporting page of our website: https://aws.amazon.com/security/vulnerability-reporting/

Thank you

[perpetual-hydrofoil]

Three years for an AWS response, and not even a "thanks for letting us know." This is mind-boggling.

As the original comment stated: yes, I did submit this issue to your security team and did not publish an exploit while waiting for a response or patch. Other researchers may not be as courteous or patient in the future.

[jdrago999]

Ha you're barking up the wrong tree, posting an issue to this project.

That said, I completely agree with you.

[perpetual-hydrofoil]

Thanks @jdrago999! Agreed. I would definitely cut some slack for a startup, but AWS is definitely not a startup.

I'm just surprised that there's so little process or transparency, especially when someone responsibly and courteously notifies regarding a vuln..

The lack of response on this thread is a concern as well; makes me a bit worried about what else is lurking in the hypervisor..