Reporting security issues
At ORENCloud, we prioritize the security of our systems and the protection of our users’ data. We value the contributions of security researchers and encourage responsible disclosure of any vulnerabilities discovered within our applications or infrastructure.
How to report a vulnerability
If you identify a potential security vulnerability in any of ORENCloud’s services, please report it to us through the following means:
- Email: Send a detailed description of the vulnerability to security@orencloud.com. Please include all necessary information to help us understand the nature and scope of the issue.
Guidelines for reporting
When reporting a vulnerability, please:
- Provide Detailed Information: Include a clear and concise description of the vulnerability, steps to reproduce it, and any potential impact.
- Avoid Public Disclosure: Do not publicly disclose the vulnerability until we have had an opportunity to address it. This helps prevent malicious actors from exploiting the issue before a fix is implemented.
- Use Test Environments: Conduct your testing on non-production environments to avoid any disruption to our services and users.
Scope of vulnerabilities
We are particularly interested in vulnerabilities that could compromise the integrity, availability, or confidentiality of our services, including but not limited to:
- Remote Code Execution
- SQL Injection
- Authentication Bypass
- Privilege Escalation
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
Non-qualifying vulnerabilities
While we appreciate all reports, certain issues are considered out of scope for our security program, such as:
- Missing HTTP Security Headers
- Clickjacking on Pages with No Sensitive Actions
- Denial of Service (DoS) Attacks
- Reports from Automated Tools without Proof of Exploitability
Our commitment
Upon receiving a vulnerability report, we commit to:
- Acknowledgment: Acknowledge receipt of your report within 5 business days.
- Assessment: Assess the reported vulnerability and determine its impact.
- Resolution: Work diligently to remediate confirmed vulnerabilities in a timely manner.
- Communication: Keep you informed of the status of your reported vulnerability throughout the process.
Recognition
We appreciate the efforts of security researchers who help us maintain the security and integrity of our services. With your consent, we would be happy to acknowledge your contributions publicly.
Legal
Please note that your testing must not violate any applicable laws or regulations. By reporting a vulnerability, you agree to permit ORENCloud to use the information provided to remediate the vulnerability and for any other lawful purpose.
Contact us
If you have any questions or need further information, please contact us at security@orencloud.com.
Thank you for helping us keep ORENCloud and our users safe.
Questions about this policy? Write to ORENCloud Sdn Bhd, Unit 3A-1B, 3A Floor, Tower 5@PFCC, Jalan Puteri 1/2, Bandar Puteri, 47100 Puchong, Selangor, Malaysia, or email info@orencloud.com.