Responsible Disclosure

Scope & Testing Rules

Testing must not cause downtime, performance degradation, data loss, unauthorized access, configuration changes, or any other operational impact to 8530Cloud or its customers.

Researchers must:

• Only perform the minimum testing necessary to confirm a vulnerability.
• Avoid disrupting, degrading, overloading or interrupting services.
• Never access, download, modify, delete or disclose customer data.
• Never attempt to compromise customer accounts, websites, databases, mailboxes or other customer resources.
• Never install malware, backdoors or persistent access mechanisms.
• Never perform phishing or social-engineering attacks against customers, staff or suppliers.
• Avoid automated scanning that generates excessive traffic or affects production systems.
• Never exploit a vulnerability beyond what is necessary to demonstrate its existence and potential impact.

Customer Protection

Customer environments are not automatically in scope simply because they are hosted on infrastructure operated by 8530Cloud.

A vulnerability affecting 8530Cloud infrastructure does not authorize access to systems or information belonging to an 8530Cloud customer.

If testing could reasonably affect a customer environment or production service, stop testing and contact 8530Cloud Security before proceeding.

Prohibited Testing

Without explicit prior authorization from 8530Cloud, the following activities are prohibited:

• DoS or DDoS testing
• Stress or load testing
• Traffic flooding
• Destructive testing
• Brute-force attacks
• Spam
• Social engineering
• Physical attacks
• Modification or deletion of data
• Intentional disruption of production services