At Nicoka, we take data security seriously and strive to ensure a secure experience when users interact with our products. When vulnerabilities are properly reported, we investigate all legitimate security vulnerabilities and address any identified issues as appropriate. We have adopted a vulnerability disclosure program to encourage the reporting of security vulnerabilities.
Share the security issue with us without making it public at any time, including, but not limited to, not disclosing it on social media, discussion forums, mailing lists, and other forums. Do not engage in security research that involves: Potential or actual harm to users, businesses, people, systems, data, or applications. Violating privacy rights or data confidentiality. Social engineering (including, but not limited to, phishing). Disrupting or interrupting our services. Port scanning on our networks or DDoS attacks. If you follow the rules of our program, we will not pursue legal action against you, nor will we ask law enforcement to investigate you, unless we have reason to believe you have not acted in good faith.
We do not offer bug bounties or rewards.
You can send the vulnerability you wish to disclose to vulnerabilities@nicoka.com or use the "Feedback" button if you are logged in. Please answer the following questions in your email:
What type of vulnerability is it?
What are the steps to reproduce the vulnerability?
Who would be able to exploit the vulnerability and what would they gain from it?
Feel free to include attachments (Screenshots, Logs, etc).
We will respond to your email within two weeks and provide updates on the status of the vulnerability.