generated: '2026-08-27'
method: searched
source: >-
  https://app.intigriti.com/programs/universityofbasel/universityofbaselvdp/detail (HTTP 200),
  confirmed against Intigriti's public programs API
  https://app.intigriti.com/api/core/public/programs (HTTP 200, 182 programs) on 2026-08-27.
provider: University of Basel
providerId: university-of-basel
program:
  published: true
  type: vulnerability-disclosure-program
  bounty: false
  platform: Intigriti
  name: University of Basel VDP
  url: https://app.intigriti.com/programs/universityofbasel/universityofbaselvdp/detail
  program_id: 618a4498-8882-406f-bfe1-b44b9acd0146
  company_handle: universityofbasel
  handle: universityofbaselvdp
  industry: education
  confidentiality: public
  status: open
  created: '2026-03-27'
  last_updated: '2026-07-09'
  last_submission: '2026-08-21'
  min_bounty:
    value: 0
    currency: EUR
  max_bounty:
    value: 0
    currency: EUR
  note: >-
    A responsible-disclosure program without bounties (min and max bounty are both EUR 0 in
    Intigriti's own public record). Scope is the university's central IT infrastructure — hosts
    under *.unibas.ch that also resolve into the university's 131.152.0.0/16 range, with
    exclusions. Safe-harbour protection is offered and researchers must not disclose without prior
    written consent. Live submissions as recently as 2026-08-21, so the program is being worked,
    not merely listed.
security_txt:
  published: false
  probes:
  - url: https://www.unibas.ch/.well-known/security.txt
    status: 503
  - url: https://ub.unibas.ch/.well-known/security.txt
    status: 404
  - url: https://edoc.unibas.ch/.well-known/security.txt
    status: 404
  - url: https://api.dasch.swiss/.well-known/security.txt
    status: 404
  - url: https://dasch.swiss/.well-known/security.txt
    status: 404
  gap: >-
    THE MOST ACTIONABLE FINDING IN THIS REPO. The University of Basel runs a real, public,
    actively-worked VDP but publishes no /.well-known/security.txt on any host in the estate — so a
    researcher (or an automated scanner) who finds a flaw on edoc.unibas.ch has no machine-readable
    path to the program that already exists. One RFC 9116 file on www.unibas.ch pointing at the
    Intigriti program would close it.
dasch:
  note: >-
    DaSCH (api.dasch.swiss) is outside the unibas.ch VDP scope, which is bounded to *.unibas.ch. It
    publishes no separate disclosure program; the documented reporting channel is the DaSCH
    helpdesk (info@dasch.swiss) and GitHub issues on dasch-swiss/dsp-api.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com