Genesis Motor America appreciates the efforts of security researchers and welcomes any information that could lead to the identification and remediation of a cybersecurity vulnerability in a Genesis Motor America product.  We will investigate and respond to all legitimate reports submitted according to the instructions below in a timely manner. Vulnerabilities and/or issues found on products, services, and IT environment outside the USA are out of scope for reporting to this vulnerability disclosure program.

By submitting a report under this program, you agree not to:

• Engage in testing or research that may harm or put at risk Genesis Motor America, its employees, its customers, riders in its vehicles, or other third party individuals or entities including Genesis Motor America related dealerships and dealership employees

• Disrupt, compromise, or harm any vehicle or data other than that which you own

• Access or disclose personal information belonging to Genesis Motor America, its employees, its customers, riders in its vehicles, or other third party individuals or entities

• Compromise or disclose confidential or proprietary data belonging to Genesis Motor America, its employees, its customers, riders in its vehicles, or other third party individuals or entities including Genesis Motor America related dealerships and dealership employees

• Test the physical security of any Genesis Motor America property or facility, or the properties or facilities of Genesis Motor America affiliates or related third parties. This includes Genesis Motor America affiliated dealerships.

• Perform any kind of denial-of-service testing or over-exhaust an IT function

• Perform social engineering, spam, or phishing/spear phishing attacks

• Perform any testing or research on systems or technology located outside the United States

• Disclose to any third party the details of any submitted vulnerability reports before Genesis Motor America can confirm complete remediation of the identified issue (if any)

• Participate or submit reports if you are employed by Genesis Motor America, or an affiliate company, or a Genesis Motor America supplier, or are acting on behalf of someone employed by Genesis Motor America. If you are a member of one these entities, please report the issue to your management, who is then to report to Genesis Motor America, directly.

In submitting reports, please note that although Genesis Motor America sincerely values vulnerability reports, we do not provide monetary compensation (“bounties”) or non-monetary remuneration in exchange for submitted reports. This program is only meant to facilitate the responsible reporting and resolution of cybersecurity vulnerabilities. 

When submitting reports, we expect that you will:

• Describe the alleged vulnerability and, where possible, include proof-of-concept code to facilitate our analysis and triage of your report

• Describe the methods you employed to identify the alleged vulnerability and any known or possible remediation

• Confirm that you are not on the U.S. Department of the Treasury’s Specially Designated Nationals List or other restricted party lists maintained by the U.S.

• Finally, please comply with all applicable laws and regulations in all work related to this program

If you identify an issue that you believe could be a cybersecurity vulnerability in any Genesis product or service, please contact us at DisclosureReporting@hmausa.com. We will be sure to respond promptly to your report.  By submitting a report, you agree that Genesis Motor America may use the information in your report in whatever ways we see fit. Genesis Motor America utilizes HackerOne services for reporting management. Please refer to the HackerOne terms and conditions at Hackerone.com/terms.