If you believe you have found a security vulnerability in an Otukan product, on otukan.co or in material we publish, email info@otukan.co. Describe the issue, how to reproduce it and what it affects. An Otukan engineer reads every report and owns it until it is resolved. This policy covers Otukan’s own code, content and infrastructure. It does not cover apps, backends or devices that belong to Otukan customers, and a report is never permission to test them. We keep you informed at every step and coordinate any publication with you.
Scope and reporting channel
Reports are in scope when the weakness lies in something Otukan builds or runs.
| In scope | Out of scope |
|---|---|
| Otukan Application Security, Device Security and Device Management | A customer’s own app code, backend or business logic |
| otukan.co, its contact forms and the App Exposure Check request flow | Devices, fleets or accounts that belong to an institution or its users |
| Documents, downloads and other material Otukan publishes | Social engineering of Otukan staff or customers |
| Infrastructure Otukan runs to deliver these products and sites | Denial of service, spam or volume testing |
| Automated scanner output without a demonstrated impact |
What a good report contains
- The product or web address affected, and the platform where it applies. Android and iOS behave differently, so name the one you tested.
- Clear steps to reproduce, with the smallest proof of concept that shows the issue.
- What an attacker could achieve, in your own assessment.
- How we can reach you, and whether you want to be named if we mention the fix.
Keep credentials, personal data and customer information out of the report. If you saw any in the course of your research, say so in general terms and do not attach it.
How we handle your report
Every report follows the same path, and the engineer who picks it up stays with it.
- Receipt. We confirm we have your report and who is handling it.
- Triage. We check scope and tell you whether the issue falls under this policy.
- Reproduction and impact. We reproduce the issue on the affected platform and assess who could be harmed.
- Fix. We fix it in the affected product or site. Where a customer needs to act, for example by rebuilding a protected app, we tell affected customers what they need to know.
- Close. We tell you the outcome and agree with you how and when findings can be published.
We keep you informed at each step. Pace follows severity: an issue that puts customers’ apps or their users at risk moves to the front of the queue.
Reporting is not permission to test
A protected app belongs to the organisation that publishes it. So do its servers, its users’ accounts and the devices it runs on. Finding a weakness in Otukan does not authorise you to exercise it against any of them.
- Test only against apps, accounts and devices you own or have written permission to test.
- Stop once you have shown the issue. Do not access, change or keep data that is not yours.
- Do not degrade any service, and do not pivot from one system to another.
- Give us the chance to fix the issue before you share details publicly.
If an issue sits in a customer’s app rather than in Otukan’s protection, report it to that publisher. For how our products protect apps in the first place, see mobile app security. How we handle data and security reviews is covered on security and trust.