Facebook is giving third-party application developers three weeks to respond to vulnerability reports and three months to patch bugs before public disclosure.
The social media giant took the wraps off a Vulnerability Disclosure Policy this week, aimed at bugs its researchers may discover in third-party code and systems, open source applications included.
The purpose of the policy, Facebook says, is to make sure that the identified issues are addressed as fast as possible and that the impacted people are informed on the matter, so they can patch their systems to stay protected.
The social platform also notes that high-impact security flaws will receive more care before public disclosure, and that its researchers will work closely with application developers to aid with the fixing process whenever needed.
“We expect the third party to respond within 21 days to let us know how the issue is being mitigated to protect the impacted people. If we don’t hear back within 21 days after reporting, Facebook reserves the right to disclose the vulnerability. If within 90 days after reporting there is no fix or update indicating the issue is being addressed in a reasonable manner, Facebook will disclose the vulnerability,” the company says.
Facebook also reveals that, should it determine that disclosing a vulnerability prior to the established timeframe would benefit the public, it may do so.
As part of the responsible disclosure process, Facebook will make a reasonable effort to contact the impacted third-party and will provide them with the information required to understand the reported problem. Additional information will be delivered if needed.
“If we do not receive a response within 21 days from a contact acknowledging the report of a vulnerability, we will assume that no action will be taken. We then reserve the right to disclose the issue,” Facebook says. The sending of the report is considered to be the beginning of the timeframe.
The company says it is willing to work with the third-party on fixes, but expects transparency on the mitigation progress. The third-party is expected to address the reported vulnerability within 90 days and, if no mitigating circumstances are identified, Facebook will disclose the issue publicly as soon as it can.
Facebook’s Vulnerability Disclosure Policy also details disclosure paths, as well as potential scenarios when the company will deviate from the 90-day patch requirement, such as active exploitation of the identified security flaw or unnecessary delays on deploying a fix.
“We will strive to be as consistent as possible in our application of this policy. Nothing in this policy is intended to supersede other agreements that may be in place between Facebook and the third party, such as our Facebook Platform policies or contractual obligations,” the social platform says.
Facebook also introduced WhatsApp Security Advisories this week, a resource designed to increase transparency through providing information on all of the vulnerabilities that have been addressed in the messaging service and applications.
“Due to the policies and practices of app stores, we cannot always list security advisories within app release notes. This advisory page provides a comprehensive list of WhatsApp security updates and associated Common Vulnerabilities and Exposures (CVE). Please note that the details included in CVE descriptions are meant to help researchers understand technical scenarios and does not imply users were impacted in this manner,” the company says.
Additionally, Facebook says it will notify developers of third-party libraries and providers of mobile operating systems when security issues that impact their code is discovered.
Related: Google Project Zero Updates Vulnerability Disclosure Policy
Related: Zero-day Vulnerability Highlights the Responsible Disclosure Dilemma