Security & Vulnerability Disclosure
At Altivora Hosting, the integrity, confidentiality, and availability of our infrastructure and customer workloads are our highest priority. We welcome responsible security research and coordinated disclosure.
[email protected]
Send security vulnerabilities, penetration testing findings, and infrastructure exploit advisories directly to our core security engineers.
Safe Harbor & Research Rules
We will not initiate legal action against security researchers who conduct testing in good faith within the following boundaries:
No Denial of Service
Do not execute stress tests or high-volume volumetric traffic against our infrastructure without prior NOC consent.
Customer Data Privacy
Do not view, alter, exfiltrate, or delete customer data. Stop testing immediately if private customer data is encountered.
Coordinated Disclosure
Allow Altivora at least 90 days to patch and verify the vulnerability before publicly disclosing details.
Social Engineering Prohibition
Do not perform phishing, physical attacks on datacenters, or social engineering against Altivora employees.
In Scope Targets
- • Main Website (
altivorahosting.com) - • Client Dashboard & Portal (
altivorahosting.com/dashboard) - • Public Cloud APIs (
altivorahosting.com/api/*) - • DNS & Anycast Edge Infrastructure
- • Cloudflare Spectrum Gateway Protections
Out of Scope Targets
- • Third-party customer servers and isolated containers
- • Upstream carrier BGP routing & physical fiber paths
- • Third-party payment processors (PayPal, Razorpay)
- • Volumetric Layer 3/4 flood testing without authorization
- • Missing SPF/DMARC records on non-sending subdomains
Initial acknowledgment: < 4 hours • Triage & Severity Assignment: < 24 hours