Security Disclosure Policy

1. Scope

Reporting scope covers the production assets we operate directly:

• This website, www.growtechcentral.com, and its API: servers we run ourselves.
• growblox.id, this site's earlier address: it forwards visitors to www.growtechcentral.com and still answers API calls.
• Public APIs and authentication endpoints reachable from the domain above.

2. Out of Scope

• Development, staging, or preview environments (e.g. domains marked -dev, -staging, -preview).
• Social engineering against our employees, partners, or users.
• Physical attacks on offices, data centers, or staff devices.
• Denial-of-service (DoS/DDoS), volumetric brute force, or load testing without coordination.
• Automated scanner findings with no proof of real impact (e.g. informational headers, public software versions, SPF/DMARC on unused subdomains).
• Other addresses under growtechcentral.com that do not serve this website, such as the proxy gateway proxy.growtechcentral.com: they run on partner infrastructure, not on our servers. Tell us what you found, but do not test them.

3. How to Report

Email [email protected]. For sensitive content, request a PGP key first via the same address.

Include the following so we can triage quickly:

• A summary of the vulnerability and the affected component.
• Clear reproduction steps (HTTP request, payload, screenshot, or a short video).
• The observed or potential impact (data exposure, privilege escalation, and so on).
• Any suggested mitigation, which really helps speed up the fix.
• The test account you used (never use another user's account without written permission from its owner).

4. Response SLA

We commit to the following timelines, counted from when the report arrives during business hours (WIB):

• Acknowledge the report: within 48 hours. You will get a confirmation that the email was received and is being routed to the security team.
• Triage and severity assessment: within 7 days. We will send an initial classification and a remediation plan.
• Fix for critical severity: within 30 days. High/medium/low timelines are communicated separately based on context.
• We will send regular updates throughout the fix and let you know once the patch is deployed.

5. Safe Harbor

Security research carried out in good faith and in line with this policy will not lead to legal action from us. As long as you:

• Stop probing once a vulnerability is confirmed and do not exfiltrate more data than needed for a proof of concept.
• Do not publish vulnerability details before we finish the fix or agree on a disclosure timeline.
• Do not use the findings to harm users or third parties.

This safe harbor clause does not cover activity that violates criminal law in Indonesia or in the jurisdiction where you are located.

6. Appreciation

Researchers who help us through this channel will be listed, with permission, on our acknowledgments page. We do not run a paid bug bounty yet, but this policy will be updated if such a program launches.