Security Contact & Vulnerability Disclosure

Report a suspected vulnerability

Email security@ovnitek.com with a concise initial description. This mailbox is for security reports and suspected abuse; ordinary customer questions and download issues belong on the Contact page.

Email is for initial coordination, not an end-to-end encrypted evidence-transfer channel. Do not send passwords, private keys, access tokens, customer records, database exports, or detailed exploit payloads. If sensitive evidence is necessary, describe the issue at a high level and ask us to agree on a safer transfer method first. We do not currently publish a PGP key.

Scope and authorization

This policy is for reporting suspected vulnerabilities in ovniTEK-controlled website code and public website features at ovnitek.com. Hosting, authentication, payment, email, analytics, and other vendor-operated infrastructure is not in scope; report issues in those providers' systems directly to the relevant provider.

This policy does not grant permission to conduct active security testing. Do not scan, probe, exploit, or attempt to access accounts or data unless ovniTEK has first given you written, specific authorization. The Terms of Use continue to apply.

Activities that are not authorized

• Accessing, modifying, downloading, or retaining another person's data or account.
• Testing payment flows with real transactions, issuing refunds, or attempting payment fraud.
• Denial-of-service, resource exhaustion, destructive tests, persistence, or malware.
• Credential attacks, brute force, phishing, social engineering, or physical testing.
• High-volume automated scanning or testing of third-party provider systems.
• Publicly disclosing an unremediated issue or identifying affected users without prior coordination.

If you unexpectedly encounter private information, stop immediately. Do not access more data, copy or share it, or continue testing. Preserve only the minimum non-sensitive information needed to explain what happened and contact us promptly.

What to include in an initial report

• A short summary and the affected public page or feature.
• The potential impact, described without exposing real user data.
• Non-sensitive observations from ordinary use; do not attempt further reproduction without written authorization.
• Your preferred contact method, if you would like a reply.

Please do not include credentials, tokens, private keys, personal information belonging to others, or unredacted logs. We may ask follow-up questions. We aim to review good-faith reports, but do not promise a specific acknowledgement, resolution, or response time.

Coordination and recognition

Please allow ovniTEK a reasonable opportunity to investigate and address a report before publicly disclosing technical details. We will coordinate next steps where reasonably possible. ovniTEK does not currently offer a vulnerability bounty or promise compensation.

Good-faith reporting under this policy is welcome. This policy does not authorize unlawful activity, testing outside the stated scope, or conduct prohibited by the Terms of Use or a third-party provider's terms. If you are unsure whether an action is authorized, ask first and wait for written approval.