Responsible Disclosure Policy
At Oridio, security is our primary product. We welcome and actively collaborate with independent researchers to find, report, and remediate vulnerabilities safely.
Safe Harbor Commitment
If you conduct vulnerability research in good faith accordance with this policy, Oridio will consider your research authorized, will not initiate legal action against you, and will work with you to understand and quickly patch the issue.
Prompt human confirmation and ticket issuance from our security team.
Technical reproduction and CVSS severity scoring.
Edge rollout of Wasm or proxy patch to global cluster nodes.
Research Scope
In Scope
- Wasm sandbox escape or edge bypass
- Redlock distributed mutex race conditions
- Authentication or tenant isolation flaws
- Data plane proxy latency manipulation or crash
- Console RBAC and secret token leakage
Out of Scope
- Volumetric Denial of Service (DDoS/DoS)
- Physical attacks or social engineering of employees
- Third-party LLM hallucinations or baseline model flaws
- Automated high-rate scanner spam
Submitting a Report
Please encrypt your report using our official PGP key and submit it to security@oridio.org. Please include detailed reproduction steps, curl commands or scripts, and expected impact.
-----BEGIN PGP PUBLIC KEY BLOCK----- Version: OpenPGP v4.2.0 Comment: Oridio Security Operations (security@oridio.org) mQGNBF/9kXgBDAC93cWbMhX2P5E7GzVq... Key fingerprint: 9E4A 28B7 6CD0 11F8 4A21 90C3 D82A 761F 3C4B 88E1 uid Oridio Security Response <security@oridio.org> -----END PGP PUBLIC KEY BLOCK-----