Coordinated Vulnerability Disclosure Policy

We welcome responsible reports of security vulnerabilities in systems, services, applications, APIs, and infrastructure belonging to the RIO Platform.

Please report vulnerabilities using the contact details in our security.txt.

Reporting

Please include enough information for us to understand and reproduce the issue, such as:

• affected system, URL, product or component
• description and security impact
• steps to reproduce
• proof of concept, screenshots, logs, or requests, if helpful
• your contact details, if you want us to follow up

Reports may be submitted anonymously without contact details, but this may limit our ability to ask questions or provide updates.

Automated scanner results should be validated and understood and contain a clear explanation of the security impact. Otherwise, arbitrary scanning tool results will be ignored.

Scope

We appreciate your help and are interested in reproducible technical vulnerabilities that may affect the confidentiality, integrity, or availability of our systems or data to keep the platform as secure as possible.

The following are out of scope:

• social engineering, phishing or attacks against employees, customers, partners, or support channels
• physical attacks or attempts to gain physical access to offices, devices or networks
• denial-of-service, resource exhaustion, stress testing, or excessive automated requests
• attacks against third-party systems not operated by us
• malware, backdoors, shells, or persistent payloads

Rules

When testing or reporting, you must:

• keep details confidential until coordinated disclosure has been agreed
• act in good faith
• test only systems in scope
• avoid privacy violations and service disruption
• use only accounts, data, and systems you own or are authorized to use
• access only the minimum information necessary to demonstrate the issue
• stop immediately if you encounter personal, confidential, or third-party data
• not misuse the vulnerability
• not modify, delete, exfiltrate, or disclose data
• comply with applicable law

Our handling

We review reports and assess whether they are reproducible, in scope, and security-relevant.

If you provide contact details, we aim to send you a confirmation of the receipt within 5 business days and may contact you for clarification, status updates, estimated processing time or disclosure coordination. We will handle the report itself and all contained data - especially personal data - confidentially and only share them with RIO Platform tenants if it is required for fixing the issue.

Confirmed vulnerabilities are handled based on severity, impact, complexity, and operational constraints.

We may reject or consolidate reports that are out of scope, not reproducible, not security-relevant, already known, already fixed, insufficiently documented, or duplicates of the same root cause.

Legal position

We will not initiate legal action against researchers who act in good faith and comply with this policy.

This does not apply to malicious activity, extortion, intentional harm, unlawful access, data theft, service disruption, privacy violations, or attacks against third parties.

No bug bounty

We do not operate a bug bounty program and do not offer monetary rewards.

We may, at our discretion and with your consent, acknowledge your contribution after the issue has been resolved.