Vulnerability Reporting

Hyundai Motor America appreciates the efforts of security researchers and welcomes any information that could lead to the identification and remediation of a cybersecurity vulnerability in a Hyundai Motor America product. We will investigate and respond to all legitimate reports submitted according to the instructions below in a timely manner. Vulnerabilities and/or issues found on products, services, and IT environment outside the USA are out of scope for reporting to this vulnerability disclosure program.

By submitting a report under this program, you agree not to:

· Engage in testing or research that may harm or put at risk Hyundai Motor America, its employees, its customers, riders in its vehicles, or other third party individuals or entities including Hyundai Motor America related dealerships and dealership employees

· Disrupt, compromise, or harm any vehicle or data other than that which you own

· Access or disclose personal information belonging to Hyundai Motor America, its employees, its customers, riders in its vehicles, or other third party individuals or entities

· Compromise or disclose confidential or proprietary data belonging to Hyundai Motor America, its employees, its customers, riders in its vehicles, or other third party individuals or entities including Hyundai Motor America related dealerships and dealership employees

· Test the physical security of any Hyundai Motor America property or facility, or the properties or facilities of Hyundai Motor America affiliates or related third parties. This includes Hyundai Motor America affiliated dealerships.

· Perform any kind of denial-of-service testing or over-exhaust an IT function

· Perform social engineering, spam, or phishing/spear phishing attacks

· Perform any testing or research on systems or technology located outside the United States

· Disclose to any third party the details of any submitted vulnerability reports before Hyundai Motor America can confirm complete remediation of the identified issue (if any)

· Participate or submit reports if you are employed by Hyundai Motor America, or an affiliate company, or a Hyundai Motor America supplier, or are acting on behalf of someone employed by Hyundai Motor America. If you are a member of one these entities, please report the issue to your management, who is then to report to Hyundai Motor America, directly.

In submitting reports, please note that although Hyundai Motor America sincerely values vulnerability reports, we do not provide monetary compensation (“bounties”) or non-monetary remuneration in exchange for submitted reports. This program is only meant to facilitate the responsible reporting and resolution of cybersecurity vulnerabilities.

When submitting reports, we expect that you will:

· Describe the alleged vulnerability and, where possible, include proof-of-concept code to facilitate our analysis and triage of your report

· Describe the methods you employed to identify the alleged vulnerability and any known or possible remediation

· Confirm that you are not on the U.S. Department of the Treasury’s Specially Designated Nationals List⁠ or other restricted party lists maintained by the U.S.

· Finally, please comply with all applicable laws and regulations in all work related to this program

If you identify an issue that you believe could be a cybersecurity vulnerability in any Hyundai product or service, please contact us at DisclosureReporting@hmausa.com. We will be sure to respond promptly to your report. By submitting a report, you agree that Hyundai Motor America may use the information in your report in whatever ways we see fit. Hyundai Motor America utilizes HackerOne services for reporting management. Please refer to the HackerOne terms and conditions at Hackerone.com/terms⁠ .