1. Responsible Disclosure Commitment
Eximtech aims to receive and evaluate clear, good-faith reports about suspected vulnerabilities affecting an Eximtech-controlled public website or system. This page defines expectations for responsible reporting; it is not a bug-bounty program or a promise of legal safe harbor.
2. What Can Be Reported
A report may describe a reproducible security weakness reasonably believed to affect an Eximtech-controlled public system. Before reporting, confirm the hostname or service appears to be operated for Eximtech and avoid testing beyond what is necessary to explain the concern.
3. Good-Faith Expectations
- Act carefully and avoid harm.
- Respect privacy and stop if personal, confidential or third-party information becomes visible.
- Use only accounts and information you are authorized to use.
- Collect the minimum evidence necessary.
- Allow reasonable time for evaluation before public discussion.
- Comply with applicable law and third-party terms.
4. Prohibited Testing
Do not perform or attempt:
- denial-of-service, load or resource-exhaustion activity;
- destructive testing, data deletion or data modification;
- social engineering, phishing or credential attacks;
- physical attacks or attempts to access facilities;
- privacy violations or access beyond what is necessary to demonstrate an issue;
- persistence, backdoors or continued access;
- malware deployment;
- disruption of Eximtech, PT Inet Teknologi Indonesia or third-party systems; or
- testing of systems that are not clearly within the relevant organization’s control.
5. Information to Include
A useful report should include:
- the affected URL, hostname or feature;
- a concise description of the suspected issue and potential impact;
- minimal, non-destructive reproduction steps;
- relevant timestamps and sanitized evidence;
- the environment used for observation; and
- a way to continue the discussion if follow-up is possible.
Do not include exploit code or sensitive data beyond what is necessary to understand the concern.
6. Sensitive Information Guidance
Do not send credentials, private keys, authentication tokens, full personal records, confidential documents or unrelated third-party data. Redact evidence where possible. If sensitive information is unexpectedly encountered, stop testing and describe the situation without copying or retaining unnecessary data.
7. How Reports Will Be Handled
Reports sent successfully through the published Contact route are delivered to the approved general Eximtech mailbox and may be reviewed, clarified, prioritized and routed to the relevant owner. Evaluation and remediation depend on scope, severity, reproducibility, system ownership and operational constraints.
No guaranteed response or remediation time is offered. Acknowledgment, status updates and disclosure coordination will depend on the circumstances and available contact information.
8. No Bug-Bounty Promise
Eximtech does not currently advertise a bug-bounty program and does not promise payment, reward, recognition or other compensation for a report.
9. Third-Party Systems
Issues affecting a third-party service should generally be reported to that service’s operator. Eximtech cannot authorize testing of another organization’s systems. A third-party integration appearing on an Eximtech workflow does not place that provider’s infrastructure within this disclosure scope.
10. Contact Route
No separate security-reporting mailbox is published. A report may be sent through the Eximtech Contact page, using the Security / Responsible Disclosure challenge. Reports are routed server-side to the approved general Eximtech mailbox.
A successful on-screen confirmation means the configured mail transport accepted the report. If the page reports a delivery failure, do not assume the report was sent. Do not use this public form for credentials, private keys, access tokens, sensitive documents or destructive proof-of-concept material.