In short
If you find a security weakness in this site or in anything Cahaves runs, email hello@cahaves.com with what you found and how to reproduce it.
Go no further than you need to show that the weakness exists. Do not touch other people's data, and do not disrupt a service.
Give us a reasonable time to fix it before you tell anyone else.
We do not take legal action over research done in good faith under these rules.
There is no paid bug bounty.
The short version is a reading aid. Where it and the full text below differ, the full text is what applies.
How to report a weakness
Email hello@cahaves.com, external link with “Security” in the subject, and tell us:
what is affected: the address, the product or the page;
what the weakness lets someone do;
the steps that show it, with any requests, screenshots or code that help;
how to reach you, if not at the address you write from.
A person reads every report. We reply to say we have yours, and again once we have decided what to do about it and when it is fixed.
What this covers
This site, and the services Cahaves runs: Cahaves Cloud, Hisabin, the Cahaves sign-in service and the house's other addresses under cahaves.com.
Services we use but do not run, such as Cloudflare, DigitalOcean, GitHub, Paddle and Zoho, are not ours to test. Report a weakness in one of them to the company that runs it.
How to look
While you look, keep to these rules:
Use only accounts and data that are yours. If you reach data that is not yours, stop, do not keep it, and tell us.
Do not degrade or disrupt a service: no denial of service, no load testing and no spam.
Do not run automated scanners that send large numbers of requests.
Do not try to trick, phish or pressure anyone at Cahaves or any of our customers.
Do not try to get physical access to an office, a server or a device.
Keep what you found to yourself until it is fixed.
Telling others
Tell us before you tell anyone else, and give us a reasonable time to fix the weakness. If you want to publish what you found once it is fixed, say so, and we will agree a date with you.
Research in good faith
If you follow these rules, we treat your research as authorised. We will not take legal action against you over it. If you are not sure whether something is allowed, ask us first.
No bounty
We do not pay for reports.
How this site is built
This site is built ahead of time and served as finished pages, over HTTPS, through Cloudflare. It holds no password, key or database connection, has no accounts and sets no cookies. Its one form sends a consultation request from your browser to Ops, which checks every field again and limits how often one email address can use it.
Contact
PT Cahaves Technology International, Bandung, Indonesia. Send security reports to hello@cahaves.com, external link.