Product Security

2. Vulnerability Disclosure Policy for Australia

Nintendo is making its Australian vulnerability disclosure policy publicly available. This policy sets out the processes by which security researchers and others may report issues to Nintendo about possible vulnerabilities in its hardware and software, and the third party software used on its hardware.

This policy may be updated from time to time to ensure Nintendo maintains transparency and clarity in dealing with security researchers and others making reports.

This policy includes:

(i) a clear explanation of the points of contact for the reporting of issues; and

(ii) information on expected timelines for the initial acknowledgement of receipt and status updates until the resolution of the reported issues.

Points of contact for the reporting of security issues or vulnerabilities

All genuine security issues or vulnerabilities with the products listed below should be reported to cyb-report@nal.nintendo.com.au:

• Nintendo Switch console

• Nintendo Switch dock with LAN port

• Software for Nintendo Switch consoles accessible to users in Australia

• Nintendo Sound Clock: Alarmo

• Nintendo Switch 2 console

• Nintendo Switch 2 dock

• Software for Nintendo Switch 2 consoles accessible to users in Australia

Please follow these instructions when you submit your report:

Encrypt your submission using our PGP key (Key Fingerprint: 37B5AC8D59D9B05489B9F72FFDF35CBC4091FBD1 / Key ID: FDF35CBC4091FBD1), and attach your own public PGP key to the email.

Include the following information in your report:

• Product name

• System version / patch number

• Steps to reproduce the issue

• Detail of vulnerability, and any suggestions to fix the issue

• Impact of the vulnerability

• Proof-of-Concept / functional sample if available;

Reward Programme:

Nintendo has enlisted the help of the HackerOne community to coordinate global vulnerability reports, pay out bug bounties and make its products more secure. If you wish to submit a report about products in scope* through HackerOne, please:

(1) email us the report ID number of HackerOne via cyb-report@nal.nintendo.com.au to receive acknowledgement of receipt and regular updates, otherwise we will not be able to track your report; and

(2) do not submit your report via email as this creates unnecessary duplication and you will not be rewarded for reports submitted outside the HackerOne programme.

* To find out which products are included in the bug bounty program, please visit https://hackerone.com/nintendo/policy_scopes

What to expect when you submit a report

When you submit a genuine report on an issue affecting security to Nintendo via the email address set out above as the point of contact, Nintendo will provide you with certain updates:

(i) You will receive an initial acknowledgement of receipt of your report within 7 working days from the date on which the report is submitted; and

(ii) You will also receive status update(s) on your security report at least every four weeks until the resolution of the issue that you reported.

In relation to the status updates, Nintendo will always act on any reported vulnerabilities in a timely manner. However, the timeframes for investigating and reporting on any vulnerability are always incident-specific.

Please note that if you are reporting on a vulnerability relating to third-party games that are playable on Nintendo consoles, the timeframe for completing the processes is dependent on the third party and therefore outside of Nintendo’s control.

Security notice for Nintendo Switch and Nintendo Switch 2

To help consumers enjoy our products securely, Nintendo provides information to customers on vulnerabilities and available security measures for the Nintendo Switch 2 console, Nintendo Switch console, Nintendo Switch Lite console, and corresponding software published by Nintendo.

For more information, please refer to: Security notice for Nintendo Switch and Nintendo Switch 2