Security · Responsible Disclosure
Security Vulnerability Disclosure
We take the security of our systems and user data seriously. If you've found a vulnerability, please disclose it responsibly via this page (anonymous accepted). We commit to prompt verification, remediation and feedback.
In Scope (please report)
- ·Authentication / authorization bypass, accessing others' data (IDOR)
- ·Injection (SQL/command/template), XSS, CSRF/SSRF
- ·Sensitive information disclosure, improper data exposure
- ·Business-logic flaws (e.g. amounts / inventory / order state manipulable unexpectedly)
- ·Cryptographic misuse, security risks from misconfiguration
Our Process
- 1.We acknowledge receipt of your report as soon as possible.
- 2.We verify and assess impact, reaching out for details if needed.
- 3.Once confirmed we schedule a fix and notify you when resolved (if you left contact info).
- 4.We appreciate every responsible researcher; significant findings are credited (with your consent).
Usually Out of Scope (please don't submit)
- ·Best-practice suggestions with no real security impact (e.g. a missing header with no exploit path)
- ·Issues requiring unrealistic preconditions (victim performing unusual actions, lost devices, etc.)
- ·Denial of service (DoS) / brute force / large-scale automated scanning against production
- ·Social engineering, phishing, physical intrusion
Safe Harbor
As long as you act in good faith, do not disclose / abuse / destroy data, do not affect other users, and disclose privately via this page within a reasonable time, we commit not to pursue legal action over your research. Please do not access data beyond what's necessary to verify a vulnerability; stop and report once found.
Or email us at: security@zhongkuaiyun.com · security.txt