McGraw Hill

McGraw Hill takes the security of our systems, products, and services seriously, and we recognize the value of the security community's expertise. We encourage responsible disclosure of vulnerabilities in our systems. Our Vulnerability Disclosure Program (VDP) provides guidelines for researchers, ethical hackers, and concerned individuals to conduct vulnerability discovery activities, and document and inform them of the results (findings) to aid us in ensuring that our customers and learners remain safe.

McGraw Hill defines a security vulnerability program as an unintended weakness or exposure that could be used to compromise confidentiality, integrity, or availability of our platforms, products, services, or user base.

Scope

The VDP covers all of McGraw Hill's attack surface (unless otherwise stated Out of Scope) and is not limited to the sites listed below.

• *.mheducation.com
• *.boardsbeyond.com
• *.mh.com
• *.mhhe.com
• *.mhprofessional.com
• *.tegrity.com
• *.mhcampus.com
• *.simnetonline.com

Out of Scope

The following discovery methods are not authorized:

• Open redirect - unless an additional security impact can be demonstrated
• Network denial of service tests (DoS or DDoS) or other tests that impair access to or damage a system or data
• Extortion, ransomware, clickjacking, or similar
• Phishing, spamming users, or other social engineering
• SPF/DKIM/DMARC
• Self-XSS
• Reports on outdated browsers
• Any non-technical vulnerability testing
• HTTP Header security related findings such as missing headers
• Attacks requiring physical access to McGraw Hill locations or properties
• Customer or user credentials discovered within credential dumps

Vendors, third-party websites, or connected services are not in scope and are not authorized under this policy. Please contact the third party directly if you believe anything should be reported.

• Beta-qa.mcgraw-hill.com
• hr.mheducation.com
• test2.mcgraw-hill.com

Disclosure Policies

Vulnerability Disclosure Philosophy
McGraw Hill believes effective disclosure of security vulnerabilities requires mutual trust, respect, transparency and common good between McGraw Hill and Security Researchers. Together, our vigilant expertise promotes the continued security and privacy of McGraw Hill customers, products, and services.

Security Researchers McGraw Hill accepts vulnerability reports from all sources such as independent security researchers, industry partners, vendors, customers and consultants. McGraw Hill defines a security vulnerability as an unintended weakness or exposure that could be used to compromise the integrity, availability or confidentiality of our products and services.

Process
If you believe you have discovered a potential or real security vulnerability in one of our products, we encourage you to notify us within 48 hours after discovery through our VDP Program.

Please provide all details available to you, including screenshots, to help us conduct our investigation, but do not undertake any research beyond what is necessary to provide your submission. All submission must be made through the HackerOne Platform.

By submitting findings, you acknowledge that you have no expectation of payment and expressly waive any future pay claims against McGraw Hill related to your submission.

After receiving the submission, we or our service provider will acknowledge receipt within 3 business days. We will conduct a thorough investigation and take appropriate action for resolution.

Guidelines
After submitting your findings to McGraw Hill, we ask you to:

• Protect the findings and all gathered evidence from unauthorized use
• Do not disclose the findings publicly or with any third party
• Do not use the information related to the findings for any purpose outside of submitting your submission to McGraw Hill
• If you encounter any personally identifiable information, stop your activity and submit a report immediately
• Do not use accounts other than your own, compromise any data other than your own, or perform any tests that will disrupt services or impair users’ ability to access the services
• Destroy any confidential data or records obtained in your discovery

If you follow the guidelines listed in this policy, McGraw Hill will not pursue any legal action against you related to your research. Disclosure of your findings to any party other than McGraw Hill will be considered as noncompliant with our guidelines and not protected by our Safe Harbor policies.

**Our Commitment to Researchers ** Trust. We maintain trust and confidentiality in our professional exchanges with security researchers.
Respect. We treat all researchers with respect and recognize your contribution for keeping our customers safe and secure.
Transparency. We will work with you to validate and remediate reported vulnerabilities in accordance with our commitment to security and privacy.
Common Good. We investigate and remediate issues in a manner consistent with protecting the safety and security of those potentially affected by a reported vulnerability.

What We Ask of Researchers
Trust. We request that you communicate about potential vulnerabilities in a responsible manner, providing sufficient time and information for our team to validate and address potential issues.
Respect. We request that researchers make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data during security testing.
Transparency. We request that researchers provide the technical details and background necessary for our team to identify and validate reported issues, using the form below.
Common Good. We request that researchers act for the common good, protecting user privacy and security by refraining from publicly disclosing unverified vulnerabilities until our team has had time to validate and address reported issues.

Vulnerability Reporting McGraw Hill recommends that security researchers share the details of any suspected vulnerabilities across any asset owned, controlled, or operated by McGraw Hill (or that would reasonably impact the security of McGraw Hill and our users) using the web form below. The McGraw Hill Security team will acknowledge receipt of each vulnerability report, conduct a thorough investigation, and then take appropriate action for resolution.

Safe Harbor

When conducting vulnerability research according to this policy, we consider this research to be:

• Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
• Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls.
• Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and
• Lawful, helpful to the overall security of the Internet, and conducted in good faith.
• You are expected, as always, to comply with all applicable laws.

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please create a ticket with HackerOne for clarification before proceeding