dropbox-fetch-processor — Design (DEFERRED)

Status: DEFERRED. Dropbox’s responsible-disclosure pipeline runs on Intigriti, which has a platform-wide ban on report disclosure. dropbox.tech/feed is a valid RSS feed but carries zero CVE IDs in any item. No /security/advisories path, no PSIRT page, no GHSAs. Dropbox is not a CNA; Dropbox-assigned CVEs do not exist as a category — only NVD-discovered Dropbox CVEs do, and those are already ingested by nist-nvd-*-processor and mitre-cve-json-processor.

1. Overview

Tier: Tier-3 SaaS (Phase 5)
Verdict: DEFERRED
Reason in one sentence: Every disclosure surface Dropbox operates is either gated (Intigriti, trust portal, DocSend), absent (/security/advisories, PSIRT, GHSAs), or CVE-free (dropbox.tech RSS); the residual NVD-discovered CVEs are already covered upstream.

2. Source contract (Phase 0 recon — 2026-05-15)

The 2026-05-09 recon predated Dropbox’s migration from HackerOne to Intigriti. This pass extends the original eight-step grid with eight additional surfaces; the verdict is unchanged.

Recon-protocol grid:

Step	Check	Finding
1–4	CSAF / CVRF / RSS / JSON feed at standard paths	None at advisory paths; `dropbox.tech/feed` is a tech-blog RSS, CVE-free
5	First-party HTML listing	`dropbox.tech/security` ~3 posts/year, architecture-only
6	GitHub Security Advisories on `github.com/dropbox`	Empty GHSA API on all pinned repos (zxcvbn, godropbox, hackpad); org mostly archived/legacy
7	CVE alias presence in any first-party content	None
8	Anti-bot / gating	trust portal + Intigriti + DocSend all gated

Expanded surfaces (2026-05-15 pass)

Surface	HTTP	Content	Implementability
`dropbox.com/.well-known/security.txt`	200	Contact `bugbounty@dropbox.com`; policy URLs at `app.intigriti.com/programs/dropbox/dropbox` (BBP) and `…/dropbox-vdp` (VDP); leaderboard URL; no advisory URL listed	N/A — points only to gated platforms
`app.intigriti.com/programs/dropbox/dropbox`	200	Program metadata only — 1353 submissions, 141 accepted; rules forbid researcher disclosure without written consent	Not usable — no submission content public
`app.intigriti.com/programs/dropbox/dropbox/leaderboard`	200	Usernames only. No CVE IDs, no titles, no descriptions	Not usable
Intigriti platform disclosure policy (KB 5379251)	n/a	“The platform currently does not offer a disclosure feature” — structural ban platform-wide	Blocks every Intigriti-hosted program by design
Intigriti REST + researcher APIs (KB 6117846, 8529303)	n/a	Auth + per-program access required; researcher API exposes program metadata, not submission content	Not usable
`dropbox.tech/feed`	200	Valid RSS 2.0; 6 recent items on encryption design, LLM security, phishing, SSRF — zero CVE IDs in any title, link, or description	Ingestable, but produces zero CVE-tagged rows
`sign.dropbox.com/security`	301 → `trust.dropbox.com`	Gated SafeBase-style trust portal	Not usable
`docsend.com/security`	403	Gated	Not usable
`www.dropbox.com/security/advisories`	404	—	No such path
`help.dropbox.com/security/security-vulnerability-advisories`	404	—	No such path
`www.dropbox.com/lp/security/our-security/security-bulletins`	404	—	No such path
`aspects.dropbox.com`	ECONNREFUSED	—	Not a hostname
CVE.org CNA registry — query “Dropbox”	n/a	No match — Dropbox is not a CNA	Dropbox-assigned CVEs do not exist as a class
`lists.openwall.com/oss-security/` 2025–2026	200	No Dropbox advisories in the period	Not a redistribution surface for Dropbox
2024 Dropbox Sign breach disclosure	n/a	SaaS breach, no CVE assigned; SEC 8-K + customer comms	Regulatory path, not advisory-feed path
`cvedetails.com/vendor/11159`	200	Lists Dropbox CVEs, all rows are NVD-sourced	Duplicate of existing `nist-nvd-*` / `mitre-cve` coverage

11. Deferral rationale + unblock conditions

Why every Dropbox-operated surface fails the implementability test:

Intigriti-hosted programs are structurally no-disclosure. The ban is platform-wide, not program-specific, so it cannot be lifted by Dropbox alone — Intigriti would have to ship a disclosure feature first. As of 2026-05-15 this is not on the public roadmap.
dropbox.tech/feed carries no CVE content. Even with aienrich running on every post, ~3 posts/year × near-zero CVE-mention rate falls well below the Vultr §15.8 commentary-enricher floor we already cited for deferral.
No /security/advisories index exists. Multiple plausible paths (/security/advisories, /lp/security/.../security-bulletins, help.dropbox.com/security/security-vulnerability-advisories) all return 404. security.txt lists no advisory URL.
Dropbox is not a CNA. Dropbox-assigned CVEs do not exist as a category. The only Dropbox-related CVE rows are NVD-discovered and already ingested by nist-nvd-recent-json-processor, nist-nvd-modified-json-processor, vulncheck-nvd-json-processor, and mitre-cve-json-processor.

What we’d accept to flip this to implementable:

Dropbox adopts a /security/advisories/ index with CVE-prefixed bulletins (analogous to AWS Security Bulletins, currently covered by aws-security-bulletins-json-processor).
Dropbox starts publishing per-repo GHSAs on github.com/dropbox/{boxcli,zxcvbn,…} — would then be picked up by the existing ghsa-* processors with no new code.
trust.dropbox.com exposes a public CVE-tagged bulletin index (rare for SafeBase trust portals — most ship policy docs only).
Intigriti ships a public disclosure feature and Dropbox opts in for their program. This would unblock the broader Intigriti-hosted advisory class, not just Dropbox.

Why not retarget as commentary enricher on dropbox.tech/feed:

Volume is far too low (~3 security posts per year, none CVE-tagged natively).
Posts arrive without a CVE id and frequently without a CWE either — the aienrich passes that fire post-commit (affected, attack, cwe, treesitter) would all run on near-empty context, with poor cost-to-value.
Falls below the Vultr §15.8 commentary-enricher deferral floor.

Recheck cadence: every 12 months. Next 2027-05-15.

Re-triggers that would short-circuit the cadence:

Intigriti announces a public-disclosure feature (industry-level signal).
Dropbox PSIRT or /security/advisories page surfaces in security.txt.
A new GHSA appears under github.com/dropbox/*.

S3 Persistence

Not used. This processor does not currently archive payloads or quarantine failures to S3. Per the S3 Persistence Contract this is non-compliant — see the compliance matrix for the implementation roadmap.

⚠ Not in the compliance matrix — status needs verification.

Expected paths when implemented:

Archive: dropbox/files/{sha256}/{filename}
Quarantine: failed-feeds/dropbox-fetch-processor/{YYYY-MM-DD}/{reason}/{filename}
Likely reasons: (none documented)