Documentation
 Discord
 Login
Cloudonix Logo
  
Sales
 Signup
  
Cloudonix Logo
Knowledge Center
Vulnerability Disclosure Policy
Knowledge Center
Vulnerability Disclosure Policy
Knowledge Center
Vulnerability Disclosure Policy

Cloudonix Vulnerability Disclosure Policy

The following vulnerability disclosure policy addresses the procedures for reporting and handling disclosures for the following properties that are in scope.

We look forward to working with the security community to find vulnerabilities in order to keep our customers safe.

Cloudonix will award bounties for any vulnerability disclosure that results in fixing an issue, as per the following guidelines.

If you would like to report vulnerabilities for any other service not listed, please do so by emailing security@cloudonix.io, though we do not guarantee any outcome nor even the possibility of receiving a reply.

Use of Platform

  • Cloudonix provides the security community with a staging platform, where its members may perform their research and identification.
  • All staging resources are designated by the staging name, as part of their FQDN, and/or resource names.
  • Research and vulnerability disclosure activities conducted on our Staging platform and consistent with this policy are considered to be “authorized” conduct under the Computer Fraud and Abuse Act, the DMCA, and other applicable computer use laws. Please note that Cloudonix production or non-staging resources are considered out of scope and are not authorized.

General Guidelines

  • Results of automatic scanning tools without a real exploit demonstration are not valid for vulnerability disclosure reports to Cloudonix, and will be ignored.
  • A distributed denial of service (DDoS) or other volumetric attacks are never eligible for the bounty program, regardless of any other consideration.
  • When multiple submissions are received for the same underlying issue (even if presented in multiple ways), we will only award the first report that was received (provided that it can be fully reproduced).
  • Social engineering (e.g. phishing, vishing, smishing and other practices) does not warrant a bounty without also referring to a fixable technical limitation.
  • Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of service. Only interact with accounts you own (created by yourself on the staging platform).

When submitting a report

  1. Make sure that you have tested and can show the work that the issue is real (not just suggested by an automated tool).
  2. Please use our staging platform to test and identify these kinds of issues at cockpit.staging.cloudonix.io  End point 
  3. Do submit detailed proof and the steps taken to produce an issue with reproducible steps. If the report is not detailed enough for our security team to reproduce the issue, the issue will not be eligible for a reward. (a video may be included if that will help demonstrate the reproduction). 
  4. Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.

Send the report to security@cloudonix.io

Services in scope

The following services are in scope of this vulnerability disclosure policy:

  • Cloudonix API services: api.staging.cloudonix.io, api.cloudonix.io
  • Cloudonix SIP services: sip.staging.cloudonix.io, wss.staging.cloudonix.io, *.sip.staging.cloudonix.io, *.staging.cloudonix.net
  • Cloudonix Cockpit: cockpit.staging.cloudonix.io

Resources without the staging designator are production services and are out of scope for the purpose of the vulnerability disclosure policy.

Vulnerability Disclosure Procedure

For each of the above listed properties, if you discover a vulnerability – please send an email, with as much details as possible, to security@cloudonix.io. Please provide – at a minimum:

  1. Your name and contact details
  2. An accurate as possible reproduction with the specific details of the service and any settings required for reproduction – a disclosure without enough details to allow our security team to reproduce the issue will be disregarded.
  3. A reference to any relevant standard or specification being violated.

Per service reward policy

Cloudonix commercial web properties

Cloudonix does not award rewards for vulnerability disclosure on our commercial web properties. These are considered

non-mission-critical and may contain multiple minor issues that are either deemed acceptable risk or are part of required

functionality – and that we have no intention of investing resources to “fix”.

 Cloudonix API services

Cloudonix will award bounties for any vulnerability disclosure that results in fixing an issue that is either:

  • Allows anonymous public access to disclose or modify non-public customer data or meta-data.
  • Allows customer’s privileged access to disclose or modify non-public data or meta-data of other customers.
  • Allows anonymous access to modify public customer data.
  • Allows customer’s privileged access to modify public data of other customers.
  • Causes a non-trivial, non-distributed, denial of service for other customers (i.e. not anonymous public access).

For the purpose of such disclosure, Cloudonix internal customer accounts are not considered customer accounts or non-public data.

Additionally Cloudonix deems customer’s privileged access gained by guessing customer controlled credentials, or by circumventing a third-party service, to be lawful access that is not a vulnerability.

Cloudonix SIP services

 Cloudonix will award bounties for any vulnerability disclosure that results in fixing an issue that is either:

  • Allows anonymous public access to create and terminate a SIP call.
  • Allows anonymous public access to disclose information about other SIP sessions.
  • Allows customer’s privileged access to disclose information about SIP sessions of other customers.

For the purpose of such disclosure, Cloudonix internal customer accounts are not considered customer accounts or non-public data.

Additionally Cloudonix deems customer’s privileged access gained by guessing customer controlled credentials, or by circumventing a third-party service, to be lawful access that is not a vulnerability.

Vulnerability Payouts

Details for all payouts are available on our HackerOne page.