generated: '2026-08-06'
method: searched
source: https://amperecomputing.com/products/product-security
program:
  name: Ampere Product Security Center (PSIRT)
  url: https://amperecomputing.com/products/product-security
  scope: Ampere silicon and platform products (Ampere Altra, Altra Max, AmpereOne)
    plus Ampere-published firmware and system software
  type: coordinated-disclosure
contacts:
- purpose: vulnerability-report
  email: psirt@amperecomputing.com
- purpose: bug-bounty
  email: BugBounty@amperecomputing.com
encryption:
  pgp: true
  note: An OpenPGP public key block is published inline on the Product Security page
    (no standalone key URL); reporters are asked to encrypt reports with it.
  tooling_referenced:
  - https://www.openpgp.org/
  - https://www.gnupg.org/
process:
  stages:
  - discovery
  - evaluation
  - mitigation
  - communication
  reporter_expectations:
  - affected product(s) and version(s)
  - detailed description with steps to replicate
  - any known exploits
  scoring: CVSS
  interim_mitigation: 'For actively exploited issues Ampere states it may ship a temporary
    containment while the complete fix is developed.'
bug_bounty:
  present: true
  platform: none
  intake: email
  contact: BugBounty@amperecomputing.com
  note: Contact-based program; no HackerOne / Bugcrowd / Intigriti listing was found.
advisories:
  published: true
  index: https://amperecomputing.com/products/product-security
  url_pattern: https://amperecomputing.com/products/security-bulletins/<bulletin>
  public_databases:
  - CVE
  examples:
  - https://amperecomputing.com/products/security-bulletins/impact-of-spectre-bhb-on-ampere
  - https://amperecomputing.com/products/security-bulletins/platypus
  - https://amperecomputing.com/products/security-bulletins/retbleed
  - https://amperecomputing.com/products/security-bulletins/hertzbleed
  - https://amperecomputing.com/products/security-bulletins/altra-spi-nor-smc
  - https://amperecomputing.com/products/security-bulletins/root-complex-OS-re-enable
  - https://amperecomputing.com/products/security-bulletins/amp-sb-0007
  - https://amperecomputing.com/products/security-bulletins/amp-sb-0008
standards_referenced:
- CVE
- CVSS
- cve.org coordinated disclosure practices
security_txt:
  present: false
  probed:
  - url: https://amperecomputing.com/.well-known/security.txt
    status: 404
  - url: https://api.amperecomputing.com/.well-known/security.txt
    status: 404
  - url: https://community.amperecomputing.com/.well-known/security.txt
    status: 404
  gap: 'Ampere runs a real PSIRT with a published contact, a PGP key and CVE-backed
    advisories, but publishes no RFC 9116 /.well-known/security.txt, so none of it is
    machine-discoverable.'
x-evidence:
  fetched: '2026-08-06'
  url: https://amperecomputing.com/products/product-security
  http_status: 200