Orum Com Vulnerability Disclosure

generated: '2026-08-13'
method: searched
probe: true
source: https://www.orum.com/responsible_disclosure
policy:
- https://www.orum.com/responsible_disclosure
contact:
- security@orum.com
program:
  type: responsible-disclosure
  bug_bounty: false
  bounty_note: >-
    Orum states "a monetary reward or a form of compensation for valid findings is up to the
    discretion of the Orum staff" — discretionary, not a bounty program. No HackerOne,
    Bugcrowd or Intigriti presence was found.
  effective_date: '2025-06-01'
  last_reviewed: '2025-06-01'
  safe_harbor: false
  safe_harbor_note: >-
    No safe-harbor language. The policy instead carries a "Disciplinary Action" clause stating
    researchers who violate it "may face legal consequences", which is the opposite posture to
    a safe harbour and worth flagging to any researcher.
  requirements:
  - report by email to security@orum.com
  - do not disclose publicly or to a third party
  - do not violate privacy, destroy data, or degrade the service
  - only interact with accounts you own
  exclusions:
  - Distributed Denial of Service (DDoS)
  - Spamming
  - Social engineering or phishing of Orum employees or contractors
  - Any attacks against Orum's physical property or data centers
security_txt:
  served: false
  note: >-
    /.well-known/security.txt returns 404 on www.orum.com, support.orum.com and trust.orum.com.
    status.orum.com DOES serve a security.txt at that path, but it is Atlassian's — signed by
    security@atlassian.com with Canonical https://www.atlassian.com/.well-known/security.txt —
    because status.orum.com is Atlassian Statuspage infrastructure. It is NOT Orum's document
    and is deliberately not credited to Orum. Publishing an RFC 9116 security.txt on
    www.orum.com pointing at this policy and security@orum.com is a ten-minute fix.
evidence:
- source: https://www.orum.com/responsible_disclosure
  kind: disclosure page
  keywords: [responsible disclosure, security vulnerability, security@, bug bounty hunters]
- source: https://trust.orum.com/
  kind: trust portal
  note: 'states "Orum operates a vulneraiblity disclosure program" (Orum''s typo) and links the policy'
x-evidence:
  fetched: '2026-08-13'
  probes:
  - url: https://www.orum.com/responsible_disclosure
    status: 200
  - url: https://www.orum.com/.well-known/security.txt
    status: 404
  - url: https://status.orum.com/.well-known/security.txt
    status: 200
    note: Atlassian's document, not Orum's — excluded from any Orum claim