RESPONSIBLE DISCLOSURE
Found a flaw in our systems? Tell us first.
We test other people's systems for a living, so we take reports about our own seriously. This page says what is in scope, how to send a report, and what happens after you do.
Put the affected host in the subject line.
PGP key available on request. Ask for it in a first message with no findings in it, and send the detail once you have the key.
What a report can cover, and what it cannot.
In scope
- linuxhackingid.com and its subdomains that we operate
- The public API gateway at api.linuxhackingid.com
- Authentication, session handling and access control across our apps
- Anything that exposes another user's data, or our clients' data
Out of scope
- Systems belonging to our clients. Report those to the client, not to us
- Denial of service, volumetric testing, and anything that degrades a live service
- Social engineering of our staff, our suppliers, or physical intrusion
- Missing hardening headers or scanner output with no demonstrated impact
- Third-party services we merely use, which have their own disclosure channels
HOW TO REPORT
One issue per report
Separate reports triage faster than a single message holding five unrelated findings.
Show us the steps
The affected URL or endpoint, the exact request, and what a reader has to do to see it happen. A short recording helps.
Prove impact, then stop
Take the minimum needed to show the issue is real. Do not read, copy, alter or delete data that is not yours, and do not pivot further into the estate.
Give us time
Please hold publication until we have had a reasonable chance to fix the issue, and talk to us before you publish so we can agree the timing together.
WHAT TO EXPECT
Acknowledgement
A human replies to confirm we have your report. We do not publish a guaranteed response time, and we would rather not state one we cannot always meet.
Triage
We reproduce the issue and tell you whether we accept it, and roughly how serious we think it is. If we disagree with your severity, we say why.
Fix and confirmation
We tell you when a fix has shipped so you can verify it yourself. If we decide not to fix something, you get that answer and the reasoning behind it.
Credit, if you want it
With your consent we will name you when we write the issue up. We do not run a paid bug bounty programme and there is no payout attached to a report.
Research in good faith is welcome. Here is what we will and won't do.
If you research in good faith, stay inside the scope above, keep to the reporting rules on this page, and give us a reasonable chance to fix what you find, we will treat your work as authorised research and we do not intend to bring a complaint or a claim against you over it.
This is a statement of how we intend to act, not a contract and not legal advice. It cannot bind anyone other than us: it does not speak for our clients, our suppliers, our hosting providers or any authority, and it does not license activity that breaks Indonesian law. If a report puts you in doubt, say so in the report and we will discuss it before anything else happens.