oviva.com
External Program
Submit bugs directly to this organization
Oviva is committed to maintaining the security of our products, services, and customer information. We appreciates and values the identification and reporting of security vulnerabilities carried out by well-intentioned, ethical security researchers. As a result, we encourage responsible reporting of any vulnerabilities that may be found in our site or applications. Oviva would like to working with security researchers to verify and address any reported potential vulnerabilities.
Please do not make vulnerabilities public without notifying us and giving us at least 2 business days to respond.
We will work together with you to understand the severity of the issue and estimate the timelines for disclosure.
We will Notify you when the vulnerability has been fixed, so that further testing can be done to confirm the remediation.
Please note that Oviva does not offer a bug bounty program. This means that Oviva does not pay rewards for disclosed security vulnerabilities. However, on a case by case basis, in consultation, we will consider providing public acknowledgement of your support.
If you believe you have found a security vulnerability, please submit your report to us using the following email address:
E-Mail | mailto:[email protected] |
PGP fingerprint | 72AB 9504 4D26 6114 E721 B9C5 6DA1 0255 D53B 55DF |
PGP public key | [https://oviva.com/.well-known/oviva-security-public.asc](Public Key) |
Your report should include details of:
Type of vulnerability or issue
Service, product or URL affected
Special configuration or requirements to reproduce the issue
Information necessary to reproduce the issue
Impact of the vulnerability together with an explanation of how an attacker could find it and exploit it
We welcome anonymous reports but we will not be able to share updates on the follow-up of the report.
Certain hacking activities constitute criminal actions. To protect you and us please act in good faith and follow these rules of ethical engagement:
Must do:
Report the vulnerability to us in the manner set out above
Always comply with data protection rules and must not violate the privacy of our users, staff, contractors, services or systems
Report the vulnerability as soon as you can, to prevent that threat actors exploit the vulnerability before we have a chance to fix it
Report the vulnerability with us while keeping the information confidential (in particular if it concerns personal data).
Must NOT do:
Break any applicable law or regulations
Access unnecessary, excessive or significant amounts of data or modify data in our systems or services
Submit reports detailing non-exploitable vulnerabilities or reports indicating that the services do not fully align with “best practice”, for example missing security headers
Demand financial compensation in order to disclose any vulnerabilities
Disclose the vulnerability to others
Use social engineering to gain access to our IT infrastructure or services
Install your own backdoor in our systems to disclose the vulnerability as this may result in unnecessary damage and security risks
Exploit a vulnerability further than necessary to confirm the vulnerability finding
Download, Modify or remove data from system
Modify the system
Use Denial of Service attacks or brute force
Use phishing
Use aggressive automated scanning
Negatively impact the Confidentiality, Integrity or Availability of our services
Execute code on our systems
Attempt to penetrate the system further than necessary to confirm the vulnerability finding
If you need further details or clarifications on this policy, please contact us at: mailto:[email protected].