Security Policy
Security Policy — Responsible Disclosure
Last updated: 2026-07-07
Contact: [email protected]
PGP: Available on request
HidenCloud is operated by HidenEnterprises. We take the security of our platform and our users' data seriously. If you have discovered a security vulnerability, we appreciate your help in disclosing it to us responsibly.
Scope
The following properties are in scope for vulnerability reports:
alpha.freepanel.hidencloud.com— hosted panel*.hidencloud.com— any subdomain serving HidenCloud infrastructure- HidenCloud mobile/desktop clients (when publicly released)
The following are out of scope:
- Vulnerabilities in third-party services or libraries that we depend on (report those to the respective maintainer)
- Social engineering attacks targeting HidenCloud staff
- Physical attacks against our infrastructure
- Denial-of-service attacks (DoS/DDoS)
- Spam or abuse of contact forms
- Issues requiring unlikely user interaction (e.g., self-XSS)
- Theoretical vulnerabilities without a working proof of concept
- Scanner output without demonstrated impact
How to Report
Send your report by email to [email protected] with:
- A clear description of the vulnerability
- The affected URL or component
- Step-by-step reproduction instructions
- Any proof-of-concept code, screenshots, or request/response captures
- The potential impact, in your assessment
If you believe the report requires confidentiality, request our PGP public key in the same email and we will provide it before you send sensitive details.
Our Commitments
Once we receive a valid report:
| Milestone | Target |
|---|---|
| Acknowledgement | Within 48 hours |
| Initial assessment | Within 5 business days |
| Status update | Every 7 days until resolved |
| Fix deployment (critical) | Within 7 days of confirmation |
| Fix deployment (high/medium) | Within 30 days of confirmation |
| Fix deployment (low/info) | Next scheduled maintenance window |
We will keep you informed throughout the remediation process and credit you in our changelog (unless you prefer to remain anonymous).
Safe Harbor
HidenEnterprises will not pursue legal action against researchers who:
- Follow this responsible disclosure policy
- Do not access, modify, or delete data beyond what is strictly necessary to demonstrate the vulnerability
- Do not exploit the vulnerability for personal gain or cause harm to users
- Do not disclose the vulnerability publicly before we have had a reasonable opportunity to remediate it (coordinated disclosure — typically 90 days)
We consider good-faith security research to be in the public interest and will work with you rather than against you.
Recognition
We maintain a public acknowledgement list for researchers who responsibly disclose valid vulnerabilities. If you would like to be listed, please include your preferred name or handle in your report.
Exclusions
The following activities are explicitly prohibited even under this policy:
- Accessing user accounts or data without authorization
- Performing denial-of-service attacks
- Sending phishing messages to users or staff
- Executing or deploying malware
- Violating the privacy of any user
This policy is subject to change. The most current version will always be available at this URL.