Arunika Vistara Digital (operating as 'Digifolks') places the highest priority on information security, architectural reliability, and the confidentiality of client data. We welcome collaboration with security researchers, ethical hackers, and the broader tech community to enhance the resilience of our infrastructure through Coordinated Vulnerability Disclosure.
We provide explicit legal safe harbor protection for researchers operating in good faith under this policy.
Mutual commitment to responsible non-disclosure while vulnerability remediation is underway.
Unambiguous rules detailing permissible target assets and strictly forbidden attack vectors.
Researchers who report qualifying valid vulnerabilities receive formal recognition and credit.
As an engineering house dedicated to building scalable enterprise operational systems, Digifolks views software security as an iterative and continuous discipline.
This policy establishes a clear, transparent, and legally protected framework for researchers to safely submit potential security vulnerabilities directly to our engineering team prior to any public disclosure.
We consider security research conducted within the scope of this policy to be authorized and beneficial to our ecosystem.
If you make a good-faith effort to comply with this policy during your security research, Digifolks commits to:
1. NOT initiating or pursuing civil lawsuits or criminal complaints (including unauthorized access allegations under Indonesian cyber law or relevant foreign statutes).
2. Supporting you and validating that your activities were authorized in the event that third parties pursue legal action against you for research conducted in compliance with this policy.
3. Collaborating transparently to validate and remediate your findings as swiftly as possible.
Safe Harbor protection strictly requires that activities do not compromise user data, disrupt production operations, or involve extortion/blackmail.
To safeguard customer uptime and confidentiality, security testing is strictly restricted to designated assets:
Researchers must adhere to the following ethical guidelines during all assessment activities:
1. Cease active testing immediately upon establishing a minimal Proof of Concept (PoC). Do not download, exfiltrate, or inspect more data than minimally required.
2. Do NOT view, modify, delete, corrupt, or disclose data belonging to other users or customers.
3. Use only test accounts or non-destructive payloads under your own control.
4. Allow Digifolks a minimum of 60 (sixty) calendar days to remediate the vulnerability before public disclosure or third-party sharing.
If you identify a vulnerability, please submit your findings to marketing@digifolks.id with a copy to digifolkstech@gmail.com.
To enable our engineering team to triage and resolve your report quickly, please include:
Our engineering team commits to following standardized timelines for all vulnerability reports:
1. Acknowledgment: We will acknowledge receipt of your report within 2 (two) business days.
2. Triaging & Validation: We will validate the technical finding and provide a severity assessment within 5 (five) business days.
3. Remediation Update: We will notify you once the fix has been deployed and verified in production.
In appreciation of your efforts to keep Digifolks and our clients safe, researchers who submit qualifying original vulnerabilities are eligible for:
1. An official Letter of Recognition / Certificate of Appreciation from Digifolks Engineering leadership.
2. Public listing in the Digifolks Security Hall of Fame (subject to your consent).
For vulnerability submissions or security policy inquiries, contact our team via the following channels:
PT Arunika Vistara Digital
Digifolks Engineering
D.I. Yogyakarta, Indonesia