Onidel Cloud is committed to protecting customer data and infrastructure. We reward security researchers for discovering and reporting vulnerabilities that could lead to cross-tenant access, privilege escalation, or bypass of fundamental platform security controls. This document outlines the rules of the program, scope of allowed security tests and responsible, coordinated disclosure policies. # In Scope Under this program, you may conduct test on the following assets of Onidel Cloud: * Cloud Panel at [cloud.onidel.com](https://cloud.onidel.com) * REST API at [api.cloud.onidel.com](https://api.cloud.onidel.com) * Compute Service (including Backups, Snapshots and Hypervisor level VM isolation) * Object Storage Service (including bucket permissions, signed URLs and Access Controls) # Out of Scope The following are **not eligible** for bounty: * Wordpress instance(s). * Rate limiting or brute force issues. * Vulnerabilities affecting third-party dependencies that have been publicly disclosed for fewer than 90 days. * Outdated software versions without a proof-of-concept exploit. * Email spoofing (SPF/DKIM/DMARC misconfigurations) that cannot lead to direct account takeover. * Self-vulnerabilities: self-XSS, clickjacking on logged-out pages, missing security headers (unless exploitable for account takeover). * Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions. * TLS configuration issues without a practical exploit. * `HttpOnly` and `secure` cookie flags. * User enumeration. * Services hosted in legacy locations that are no longer available for new orders through our website will be reviewed on a case-by-case basis. ## Strictly Prohibited * **Social engineering**: Phishing, vishing, or physical social engineering of Onidel employees. * **Denial of Service (DoS)**: Volumetric or resource-exhaustion attacks. * Usage of large-scale vulnerability scanners or automated tools which could lead DoS of Onidel core services. * **Physical attacks**: Physical data center access, hardware tampering, side-channel attacks. * Any attacks aimed at Onidel customers: Security testing is **only allowed** on resources that you **own** or got permission to access. # Rewards Onidel Cloud calculates bounty rewards based on the demonstrated consequences and business impact of a successful attack. We do not strictly follow CVSS scores, as a vulnerability's theoretical score may not reflect its actual impact on a multi-tenant cloud environment. Reported successful attacks are evaluated on the scale of risk level and potential impact to Onidel and its customers. We will perform this classification on case-by-case basis and estimate the bounty amount. Below listed are bounty levels and example attack scenarios we consider eligible for receiving reward of given tier. ## Severity Levels ### Criticial ($500) * Remote Code Execution with elevated privileges within Onidel infrastructure. * Arbitrary takeover of another customer’s account. ### High ($200-$300) * Exposure of Onidel Cloud Platform secrets, including access tokens, passwords, API keys, or private keys. * Unauthorised access to another customer's data or resources without requiring any interaction from the victim (e.g. IDOR, SSRF). * Unauthorised access to sensitive personal information (email, address, phone number) affecting multiple customers. * Authentication bypass. ### Medium ($100-$200) * Execution of action as other customer with some required interaction (eg. XSS) * Improper Access Controls limited to a single service ### Low Severity ($25-$50) * Billing/Quota Bypass allowing to provision resources without being billed or bypass quota restrictions imposed. * Open redirect that cannot be chained with SSRF or token theft. ### Informational ($0-$25) * Leak of internal IP addresses (non-exploitable alone). * Security issues in default software configuration not leading to any other vulnerability. * Verbose error revealing stack trace with non-sensitive paths. # Payments The bounty payments may be issued as: * Onidel Account Credits (preferred, especially for smaller payouts) * PayPal, Wise and Wire-transfer ($50 and more) # Safe Harbor If you conduct your research in good faith and in accordance with this policy, Onidel considers your actions authorised. We will not initiate or recommend legal action against you, and we will work with you to understand and resolve the issue quickly. If you are ever unsure about the consistency of your security research in accordance to this policy, please [submit a ticket](https://cloud.onidel.com/account/tickets/new) presenting your current and planned actions before proceeding further. # Eligibility To be eligible for bounty, you must meet all the eligibility requirements. * You must not break any terms outlined in this policy. * You need to be the first person to disclose an unknown vulnerability. * You may not be current or a former Onidel employee. * You must not leak, store, manipulate, or destroy any user data. * While doing research you may only use accounts under your control. You are allowed to create multiple accounts, but the billing details on all of them should remain consistent. * Any tickets opened for testing purposes should be prefixed with `[vulnerability testing]`, to not disrupt the operations of Onidel support team. * Any vulnerability found must be reported no later than 48 hours after discovery. * Reports from automated scanning tools alone are not considered for bounty. * Any AI generated reports will be rejected outright without bounty eligibility. * You are not allowed to disclose details about the vulnerability anywhere else until the successful patch is implemented by Onidel. * Publishing details via any unofficial channels before reporting the vulnerability in accordance to Disclosure Policy will make it ineligible for bounty. * You must not engage in any attempt of bounty extortion or artificially inflating the set bounty amount. # Disclosure Policy In order to receive a [reward](#Rewards), you need to follow responsible disclosure guidelines. * Submit a report via [ticket](https://cloud.onidel.com/account/tickets/new) or [email](mailto:security@onidel.com) detailing the required conditions, actions and consequences of successfully exploited vulnerability. Describe steps to reproduce it reliably, providing proof of exploitation on your side (screenshots, videos, relevant requests and logs, PoC script if possible). * In case the vulnerability is not reproducible by Onidel, we may ask for additional details. * If your report contains sensitive information, please **encrypt it using our PGP key** at . * Provide list of all Onidel accounts used during security testing as well as the time range during which the testing was performed. * Suggest ways to fix reported vulnerability (this is optional but highly welcome). We will respond within 48 hours and triage within 7 business days. Any delays will be communicated. Happy hacking ;)