Email security@tehclabs.my. Please do not open a public issue for a security report, and please do not post one in a repository's discussions.
Include what you need to make it reproducible: the affected host or endpoint, the steps, and what you were able to reach. If you have a proof of concept, send it; if sending it is itself risky, describe it and we will arrange something.
| Acknowledgement | within 3 working days |
| First assessment | within 10 working days |
| Fix or a dated plan | communicated to you directly |
We operate from Malaysia (UTC+8) and respond on working days. If you have not received an acknowledgement within that window, please resend. Mail does occasionally fail to arrive, and we would rather see a report twice than not at all.
Our production services and the software behind them, including
tehclabs.my and condo-os.my.
Out of scope: findings that require physical access to a device already signed in; reports generated by a scanner with no demonstrated impact; and anything whose proof of concept would require accessing another party's data. If a serious finding can only be demonstrated that way, stop and describe it to us instead. Do not collect the data.
Run denial-of-service or load tests against production, access or retain data belonging to anyone else, or make changes that affect other users. Testing that stays within your own account is welcome.
We do not run a paid bounty. We will credit you by name or handle if you want that, and not if you do not.