Report it. You will get an acknowledgement, not a template.
We would rather hear about a problem from you than read about it. This page says how, and what you can expect.
Report a vulnerability
Email security@dhuritech.com. Include what you found, where, and how to reproduce it. Our machine-readable policy is at /.well-known/security.txt.
We will acknowledge your report, keep you informed while we fix it, and credit you if you wish once it is resolved.
In scope
dhuritech.comand its subdomains that we operate, including Dhuri One and Dhuri Gateway.- Our open-source SDKs and plugins, such as the Dhuri Java SDK and the Dhuri Gateway WHMCS module.
Out of scope
- Denial-of-service, volumetric or rate-limit testing, spam and social engineering of staff or customers.
- Reports from automated scanners with no demonstrated impact, and missing best-practice headers with no exploit.
- Third-party services we use. Report those to the vendor.
Our promise to you
If you act in good faith, test only against accounts you own, avoid accessing other people’s data, and give us reasonable time to fix before disclosing, we will not pursue legal action and we will work with you. Stop and tell us immediately if you encounter personal data or payment information.
Practices behind the products
These are implemented today, taken from the products themselves rather than from aspiration. Per-product detail is in each product’s documentation.
- Dhuri One: strict separation between customers, credentials that are never stored in the clear, secure sessions, and an audit record of sensitive changes.
- Dhuri Gateway: authenticated and tamper-resistant requests, encrypted provider credentials, two-step sign-in for administrators, and payments confirmed with the provider before they count.
- This website: static files with no database, no cookies and no third-party scripts or fonts, served over HTTPS with a strict content security policy.
We do not currently hold a third-party certification such as SOC 2 or ISO 27001, and we do not claim one.