Security & Vulnerability Disclosure Policy

Last updated:

Security is a core part of what PT Baris Kode Solution (“Baris Kode”, “we”, “us”) does for our clients, and we hold ourselves to the same standard. If you believe you have found a security vulnerability in one of our systems, we want to hear about it, and we will work with you to fix it.

This policy explains how to report a vulnerability, what is in scope, the rules we ask you to follow, and what you can expect from us. A machine-readable summary is available at /.well-known/security.txt.

1. How to report a vulnerability

Email info@bariskode.com with the subject line “Security report”. Please include:

  • a description of the vulnerability and its potential impact;
  • the affected URL, system or component;
  • step-by-step instructions to reproduce it, including any proof-of-concept;
  • the date and time of your testing, and the IP address you tested from, if possible;
  • how you would like to be credited, if at all.

You may write in English or Indonesian. Please do not report vulnerabilities through public channels, such as social media or public GitHub issues, before they have been fixed.

2. Scope

2.1 In scope

  • The website bariskode.com and its subdomains operated by Baris Kode.
  • Services, applications and infrastructure that Baris Kode itself owns and operates, including our own published products.

2.2 Out of scope

  • Client systems, including websites and applications we built or manage for clients, unless that client has authorized you in writing to test them. If you find an issue in a client system, you may report it to us and we will pass it to the client, but this policy does not authorize testing it.
  • Social engineering, phishing or physical attacks against our staff, offices or clients.
  • Denial-of-service attacks, load testing, or anything that degrades availability.
  • Spam, or automated submission of the contact form.
  • Vulnerabilities in third-party services we use, such as Netlify, Cloudflare or Web3Forms — please report those to the provider directly.
  • Missing security headers or best-practice settings without a demonstrable security impact.
  • Self-XSS, or issues that require the victim to paste code into their own browser.
  • Clickjacking on pages without sensitive actions.
  • Reports generated only by automated scanners, without a verified impact.
  • Vulnerabilities that require an outdated or unsupported browser, or a compromised device.

3. Rules for researchers

When investigating a vulnerability, please:

  • access, copy or modify only the minimum data necessary to demonstrate the issue, and stop as soon as you have confirmed it;
  • not view, download, retain or disclose personal data belonging to others; if you encounter any, stop, report it to us and delete it;
  • not degrade, disrupt or damage our systems or anyone else’s, and not use automated tools in a way that generates significant traffic;
  • not use the vulnerability for any purpose other than verifying it, such as pivoting to other systems or installing persistent access;
  • not demand payment or other benefits in exchange for not disclosing a vulnerability;
  • give us reasonable time to fix the issue before disclosing it publicly — we ask for 90 days from your report, or less if we have released a fix earlier and agreed on disclosure with you.

4. Our commitments

When you report a vulnerability in good faith under this policy, we will:

  • acknowledge your report within 3 business days;
  • investigate, confirm the issue and tell you our assessment;
  • keep you informed of our progress toward a fix;
  • let you know when the issue has been fixed and coordinate any public disclosure with you;
  • credit you publicly for the discovery, if you wish.

5. Safe harbor

If you make a good-faith effort to comply with this policy, we consider your research authorized, and we will not pursue or support legal action against you, including under UU ITE, in relation to that research. If a third party takes legal action against you for activity that complied with this policy, we will make it known that your research was authorized by us.

This safe harbor applies only to systems within scope and to Baris Kode. We cannot authorize testing of systems owned by third parties, including our clients and service providers, and cannot bind them.

If you are unsure whether something is in scope or allowed, ask us at info@bariskode.com before you proceed.

6. Rewards

We do not currently run a paid bug bounty program, so we cannot offer monetary rewards. We are, however, genuinely grateful for responsible reports and are happy to give public credit.

7. How we protect our own systems

Our website is served only over HTTPS with HTTP Strict Transport Security, uses a strict Content Security Policy that only allows scripts we have approved, loads very little third-party code and sets no cookies. More about how we handle data is in our Privacy Policy.

8. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it was last revised. The version in effect at the time of your report applies to it.

9. Contact