Vulnerability Disclosure Policy

Security

The following vulnerability disclosure policy addresses the procedures for reporting and handling disclosures for the properties that are in scope below.

We look forward to working with the security community to find vulnerabilities in order to keep our customers safe. Cloudonix will award bounties for any vulnerability disclosure that results in fixing an issue, per the guidelines below.

If you would like to report a vulnerability for a service not listed here, please email security@cloudonix.io, though we do not guarantee any outcome, nor even the possibility of a reply.

Use of Platform

• Cloudonix provides the security community with a staging platform, where members may perform research and identification.
• All staging resources are designated by the staging name, as part of their FQDN and/or resource names.
• Research and vulnerability-disclosure activities conducted on our staging platform, consistent with this policy, are considered "authorized" conduct under the Computer Fraud and Abuse Act, the DMCA, and other applicable computer-use laws. Cloudonix production or non-staging resources are considered out of scope and are not authorized.

General Guidelines

• Reports without a real exploit demonstration — including those generated purely by automatic scanning tools, or that used AI in the creation of the vulnerability report — are not valid and will be ignored.
• A distributed denial-of-service (DDoS) attack or other volumetric attack is never eligible for the bounty program, regardless of any other consideration.
• When multiple submissions are received for the same underlying issue (even if presented in different ways), we will only award the first report received, provided it can be fully reproduced.
• Social engineering (phishing, vishing, smishing, and similar practices) does not warrant a bounty unless it also identifies a fixable technical limitation.
• Make a good-faith effort to avoid privacy violations, destruction of data, and interruption or degradation of service. Only interact with accounts you own (created by yourself on the staging platform).

When Submitting a Report

1. Make sure you have tested and can demonstrate that the issue is real, not just suggested by an automated tool.
2. Use our staging platform to test and identify these kinds of issues, at cockpit.staging.cloudonix.io.
3. Submit detailed proof and the steps taken to reproduce the issue. If the report is not detailed enough for our security team to reproduce it, it will not be eligible for a reward (a video may be included if it helps demonstrate reproduction).
4. Submit one vulnerability per report, unless you need to chain vulnerabilities to demonstrate impact.

Send reports to security@cloudonix.io.

Services In Scope

The following services are in scope of this vulnerability disclosure policy:

• Cloudonix API services — api.staging.cloudonix.io, api.cloudonix.io
• Cloudonix SIP services — sip.staging.cloudonix.io, wss.staging.cloudonix.io, *.sip.staging.cloudonix.io, *.staging.cloudonix.net
• Cloudonix Cockpit — cockpit.staging.cloudonix.io

Resources without the staging designator are production services and are out of scope for this policy.

Vulnerability Disclosure Procedure

For each property listed above, if you discover a vulnerability, send an email with as much detail as possible to security@cloudonix.io, including at minimum:

1. Your name and contact details
2. As accurate a reproduction as possible, with the specific service details and any settings required — a disclosure without enough detail for our security team to reproduce the issue will be disregarded
3. A reference to any relevant standard or specification being violated

Per-Service Reward Policy

Cloudonix Commercial Web Properties

Cloudonix does not award rewards for vulnerability disclosures on our commercial web properties. These are considered non-mission-critical and may contain minor issues that are either an acceptable risk or part of required functionality, which we have no intention of investing resources to fix.

Cloudonix API Services

Cloudonix will award bounties for any vulnerability disclosure that results in fixing an issue that:

• Allows anonymous public access to disclose or modify non-public customer data or meta-data
• Allows a customer's privileged access to disclose or modify non-public data or meta-data of other customers
• Allows anonymous access to modify public customer data
• Allows a customer's privileged access to modify public data of other customers
• Causes a non-trivial, non-distributed denial of service for other customers (i.e., not via anonymous public access)

For the purpose of such disclosure, Cloudonix internal customer accounts are not considered customer accounts or non-public data. Additionally, Cloudonix deems privileged access gained by guessing customer-controlled credentials, or by circumventing a third-party service, to be lawful access and not a vulnerability.

Cloudonix SIP Services

Cloudonix will award bounties for any vulnerability disclosure that results in fixing an issue that:

• Allows anonymous public access to create and terminate a SIP call
• Allows anonymous public access to disclose information about other SIP sessions
• Allows a customer's privileged access to disclose information about SIP sessions of other customers

For the purpose of such disclosure, Cloudonix internal customer accounts are not considered customer accounts or non-public data. Additionally, Cloudonix deems privileged access gained by guessing customer-controlled credentials, or by circumventing a third-party service, to be lawful access and not a vulnerability.

Vulnerability Classification