Vulnerability Disclosure

If you believe you have discovered a security vulnerability in a GlobalPlatform specification or certification, please report it to us. We welcome reports from everyone, including both members and non-members.

All reports should follow the process for reporting, as specified in the GlobalPlatform Technology Vulnerability Disclosure and Mitigation Process, and be sent via email to: vulnerability@globalplatform.org.

Please use GlobalPlatform’s PGP key to encrypt sensitive information sent via email:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEZZxUrhYJKwYBBAHaRw8BAQdAgUB2MuxC2BYWpMlxgz+4qAKvTCCZc7niECUp
FYFXbm+0M0dQIFZ1bG5lcmFiaWxpdHkgPHZ1bG5lcmFiaWxpdHlAZ2xvYmFscGxh
dGZvcm0ub3JnPoiTBBMWCgA7FiEElEzJ9xFsPESk/04gNzTfd5PqWAsFAmWcVK4C
GwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQNzTfd5PqWAudrQD+NqOI
yCD2lozTA0XSsHWVPfAJs/uN4k95I/lsKC8X5OkA/ApgV0l6iT585kXT50gBSX9s
M2AF2VBSVoeCZPtpvygLuDgEZZxUrhIKKwYBBAGXVQEFAQEHQODCroy6g6bcQsQ6
LX70EeMFgVjVM5spRDB5/rNZ0DMEAwEIB4h4BBgWCgAgFiEElEzJ9xFsPESk/04g
NzTfd5PqWAsFAmWcVK4CGwwACgkQNzTfd5PqWAsb5gD8Dxhq6MNXeKyAj7/WS812
j3zAJHuAwDbGfTNqVk7qeAgA/iN2AXQDjRlFfH5JCzMk2yZ7XedocCxHeteGsD65
ViMA=7dJf

-----END PGP PUBLIC KEY BLOCK-----

Within 72 hours of receipt, GlobalPlatform will provide an email acknowledging receipt of your report, and we’ll contact you if more information is needed.