Rivian Vulnerability Disclosure Program

Description

Rivian exists to create products and services that help our planet transition to carbon neutral energy and transportation. Rivian designs, develops, and manufactures category-defining electric vehicles and accessories and sells them directly to customers in the consumer and commercial markets. Rivian complements its vehicles with a full suite of proprietary, value-added services that address the entire lifecycle of the vehicle and deepen its customer relationships.

Rivian welcomes responsible reports of potential security vulnerabilities affecting our products and services. Please submit your findings through this Vulnerability Disclosure Program to help our security team track and review your report. This program does not offer monetary rewards.

Rules of engagement

By participating in this program, you agree to:

• Respect the Community Code of Conduct (https://go.intigriti.com/coc)
• Respect the Intigriti Terms and Conditions (https://go.intigriti.com/tac)
• Respect the terms at Rivian Cybersecurity Vulnerabilities (https://rivian.com/legal/vulnerability)
• You may not participate in this program if you are ordinarily resident in, or located in, any country or region subject to comprehensive sanctions, or if you are an individual or entity identified on any applicable sanctions list (including those administered by OFAC, the EU, the UN, or the UK's OFSI).
• Respect the scope of the program
• Not discuss or disclose vulnerability information without prior written consent (including, but not limited to, PoC's on YouTube and Vimeo)
• Rivian participates in Safe Harbor

Safe Harbor

Rivian will not initiate legal action under the Computer Fraud and Abuse Act (“CFAA”), Digital Millennium Copyright Act (“DMCA”), or similar law against you nor request law enforcement to investigate you for activities conducted in a manner consistent with the Program Rules, the Rivian Terms, and the Intigriti Community Code of Conduct and Researcher Terms and Conditions.

Validation times

We will validate all submissions within the below timelines, once your submission has been verified by Intigriti.

In scope

Introduction

Welcome to our Vulnerability Disclosure Program! We are rigorously working behind the scenes, cleaning up known issues in our software systems, but we are aware that there could be other undiscovered vulnerabilities. As part of our commitment to ensure the safety and privacy of our vehicles and customers, we are extending an invitation to skilled individuals to assist us in identifying these vulnerabilities.

This program accepts vulnerability reports affecting Rivian’s products, services, and software, including those not individually listed in the assets section. Third-party systems remain out of scope.

Our worst-case scenarios are:

The scenarios that worry us the most revolve around the safety of our drivers and the integrity of our vehicles. Some of these scenarios include but are not limited to:

Remote control of vehicle systems: Any vulnerability that could allow unauthorized remote control of any vehicle systems. Reports of vulnerabilities affecting Rivian vehicles, including vehicle software, are welcome. Testing that could endanger people, damage property, or disrupt vehicle operation is prohibited.

Privacy invasion: Vulnerabilities that could allow unauthorized access to private user data stored in our systems, including but not limited to personal identification information, location data, or payment details.

Disruption of communication: Any bugs that could interrupt communication between the vehicle and the central control system, potentially leaving vehicles isolated or unresponsive to vital updates and commands.

Any useful infrastructure information:

Business Site

Business portal (https://business.rivian.com) is used to support our Fleet customers. This application requires Fleet credentials which a general commercial customer would not have. The primary testing for this domain is the authentication/authorization of the publicly available endpoints.

Basecamp

Basecamp (basecamp.rivian.com) is an externally exposed portal for Rivian partners. We do not provide an option for customers or security researchers to create credentials for authenticated testing. Rather the scope of testing for this domain is authentication bypass.

Out of scope

Third-party infrastructure and redirects

Third-party infrastructure and redirects are out of scope. Examples include:

• careers.rivian.com
• media.rivian.com
• stories.rivian.com
• demovehicles.rivian.com
• cloud.e.rivian.com
• view.e.rivian.com
• feedback.rivian.com
• internalshop.rivian.com

Finding exclusions

The following are out of scope when reported without evidence of a security impact:

• Automated scanner results or reports that software is outdated or vulnerable, without demonstrating an applicable vulnerability.
• Version disclosure, open ports, directory listings, or verbose error messages that do not expose sensitive information or enable an attack.
• Missing security headers, cookie flags, or other best-practice settings without a demonstrated exploitation scenario.
• Missing mobile hardening controls, such as obfuscation or root detection, without a demonstrated exploitation scenario.
• Missing certificate pinning alone. Certificate-related findings must identify the specific vulnerable certificate or version and demonstrate its security impact.
• Self-XSS that cannot be used to affect another user.
• Theoretical issues without a realistic attack scenario.

A finding will not be excluded solely because it falls into one of these categories if the report demonstrates meaningful security impact. Please explain the impact and provide reproducible evidence obtained through safe, authorized activity.

Prohibited testing activities

• Spam, social engineering, and physical intrusion.
• DoS/DDoS attacks, brute-force attacks, or other testing that disrupts live services.
• Testing that endangers people, damages property, or interferes with vehicle operation.
• Accessing or testing another person’s accounts, devices, or vehicles without authorization.

These restrictions apply to testing activities. You may report a potential vulnerability without carrying out harmful actions to demonstrate it.

General

• Reports of issues already known to Rivian may be marked as duplicates.
• Vulnerabilities that only work on software that no longer receives security updates are out of scope.
• Vulnerabilities limited to browsers more than three versions behind the current release are out of scope.
• For recently disclosed vulnerabilities in commercial products, please allow two weeks after a patch or mitigation becomes publicly available before reporting, to give us time to update our systems.

Severity

This program follows Intigriti's triage standards based on the proof of concept.

FAQ

Do I need an Intigriti account to submit a report?

You can submit through your Intigriti account or use Rivian’s anonymous submission form without an account. If you use the anonymous form, please provide an email address so we can contact you if further information is needed.

Does this program offer monetary rewards?

No. This Vulnerability Disclosure Program does not offer monetary rewards. Researchers seeking bounty eligibility should review the scope and requirements of the Rivian Bug Bounty Program before submitting a report.

Rewards

This Vulnerability Disclosure Program does not offer monetary rewards. Researchers seeking bounty eligibility should review the scope and requirements of the Rivian Bug Bounty Program before submitting a report.