osx-serial-generator VS securitytxt.org

easy way to find a valid number is too generate tons and verify them one by one on the apple website as said into the previous link of point 11 use this to generate: https://github.com/sickcodes/osx-serial-generator

You serial HAS to be invalid. There are some criteria that you should follow (it's only partially random), but all of the guides warn you that your generated serial should always result as invalid for Apple: otherwise it'd mean you just generated someone else's serial by accident. If you don't want to do it manually or following the standard guides, there are open source, safe utilities to generate one: https://github.com/sickcodes/osx-serial-generator . I can assure you that getting iServices to work is fairly easy, nowadays.

Here you go: https://github.com/sickcodes/osx-serial-generator and you also need Open Core Configurator or similar software to mount the hidden efi partition

I'm using this script to build the VMs, applying serial numbers and HW model generated with this script. The guests enroll over the hosts VPN and once they get the config profile installing machine certs I can get them on VPN directly, enroll, and start testing.

Link : https://github.com/sickcodes/osx-serial-generator

Generate Complete Sets of Serial Numbers for OS X-KVM, Docker-OS X, OpenCore\ (6 comments)

The code is relatively easy to read if you want to see: https://github.com/sickcodes/osx-serial-generator/blob/master/generate-unique-machine-values.sh

You might consider setting up security.txt notifications, per RFC 9116, to funnel people into the right notification paths. Otherwise, they might try spamming random emails they find or can guess at. I've had external researchers contact our CTO and CEO directly, creating a new problem for me.

Check if they have a security.txt, if they do not, check their /security. If both come up empty, use any contact form that they have available.

In addition to the Bug bounty programs already posted in the comments, I'd suggest you create a security.txt with a dedicated security contact.

Does the website have a responsible disclosure page or a security.txt?

there's technically https://securitytxt.org as well; but sadly it's not in super duper wide deployment (some big places have it, though!)

Especially in the area you guys are operating in, I think it would be great if you could implement RFC 9116 (https://securitytxt.org/). If someone finds a vulnerability on your website, the client or even the SPN, this would make communication or a responsible disclosure process much easier. Furthermore, it would be great if the possibility for secure communication with your staff (e.g. using GPG) would be possible.

When do companies finally start adopting the `security.txt` proposal (see https://securitytxt.org).

Would have made a big difference!