Technology & Security

Orange Cap Media welcomes good-faith reports from security researchers, clients and other individuals who identify suspected vulnerabilities affecting the Company's websites, applications or related systems. Responsible disclosure helps reduce risk and improve protection for users and clients.

Reports should be sent to security@orangecapmedia.com and should include, where possible, the affected URL or system, a clear description of the issue, steps to reproduce it, the potential impact and the reporter's contact information. Screenshots, logs or proof-of-concept details may be helpful but should avoid unnecessary exposure of personal data.

Testing must not include denial-of-service attacks, destructive exploitation, interference with production services, social engineering of employees or clients, physical intrusion, spam, or attempts to access, modify or delete data belonging to other users. Testing should remain within the scope reasonably necessary to demonstrate the vulnerability.

If a researcher inadvertently accesses personal data, credentials or other confidential information, they should stop further access, avoid copying more data than necessary to demonstrate the issue and include only the minimum relevant evidence in the report. Orange Cap Media may request secure transfer methods for sensitive findings.

Orange Cap Media should be given reasonable time to investigate, validate and remediate a reported issue before public disclosure. Submission of a report does not automatically entitle the reporter to payment, recognition or a bounty unless Orange Cap Media has expressly announced such a programme in writing.