Our Commitment to Security

Security is an ongoing process that requires continuous improvement, monitoring, testing, and collaboration. While Digital 2Moro implements multiple layers of security controls across our infrastructure, applications, operational processes, and client services, no system can ever be guaranteed to be completely free from vulnerabilities.

We recognize that responsible security research contributes positively to the protection of digital ecosystems and helps organizations identify weaknesses before they can be exploited maliciously.

• Commitment to maintaining secure systems and services.
• Encouragement of responsible vulnerability reporting.
• Constructive collaboration with security researchers.
• Continuous improvement of security controls and practices.
• Protection of clients, users, and operational assets.

Reporting Security Vulnerabilities

If you believe you have discovered a security vulnerability affecting a Digital 2Moro website, application, service, infrastructure component, API, client portal, authentication mechanism, or other technology asset under our control, we encourage you to report it responsibly.

Reports should include sufficient detail to allow our team to understand, validate, reproduce, and investigate the issue effectively.

• Description of the identified vulnerability.
• Steps required to reproduce the issue.
• Affected URLs, systems, applications, or components.
• Proof-of-concept information where appropriate.
• Potential impact and severity assessment if known.
• Researcher contact information for follow-up communication.

How to Submit a Report

Security reports should be submitted through official communication channels to ensure they are received, tracked, and reviewed by the appropriate personnel.

When reporting a vulnerability, please provide clear and accurate information that allows our team to investigate efficiently.

• Email security-related reports to the designated security contact.
• Include detailed reproduction steps whenever possible.
• Provide screenshots, logs, or supporting evidence when appropriate.
• Include your preferred contact information.
• Avoid publishing vulnerability details before remediation discussions occur.

Good Faith Security Research

Digital 2Moro supports security research conducted in good faith with the objective of improving security and protecting users. We appreciate researchers who act responsibly, avoid unnecessary disruption, and provide organizations with a reasonable opportunity to investigate and remediate vulnerabilities.

We encourage researchers to focus on identifying vulnerabilities without compromising the privacy, availability, confidentiality, or integrity of systems and data.

• Act responsibly and ethically during testing activities.
• Minimize the impact of testing on systems and users.
• Avoid accessing unnecessary data or sensitive information.
• Report vulnerabilities promptly after discovery.
• Allow reasonable time for investigation and remediation.

Scope of Responsible Testing

Responsible testing should be limited to systems, services, applications, domains, APIs, and infrastructure assets that are owned or directly operated by Digital 2Moro. Activities affecting third parties, clients, partners, vendors, or unrelated systems fall outside the scope of this disclosure process unless explicitly authorized.

• Public Digital 2Moro websites and web applications.
• Public APIs and digital services operated by Digital 2Moro.
• Client systems only where explicit authorization exists.
• Authorized testing of publicly accessible assets.
• Activities conducted without causing service disruption.

Out-of-Scope Activities

Certain activities may create unacceptable risk, violate legal obligations, compromise users, or interfere with business operations. These activities are not considered responsible disclosure and should not be performed.

• Unauthorized access to personal, confidential, or client information.
• Data exfiltration, copying, downloading, or retention of sensitive information.
• Denial-of-service (DoS) or distributed denial-of-service (DDoS) testing.
• Social engineering, phishing, or impersonation attacks.
• Physical security testing without authorization.
• Malware deployment or malicious code execution.
• Attempts to disrupt production systems or services.
• Testing that affects other users, customers, or third parties.

Vulnerability Review Process

Once a report is received, Digital 2Moro follows a structured review process to evaluate the reported issue. The investigation process helps determine the validity, severity, scope, and potential impact of the reported vulnerability.

• Receipt and acknowledgment of submitted reports.
• Initial triage and validation activities.
• Technical investigation and impact assessment.
• Prioritization based on severity and business risk.
• Assignment of remediation activities.
• Verification and closure after corrective action.

Severity & Prioritization

Not all vulnerabilities present the same level of risk. Digital 2Moro prioritizes remediation efforts based on factors such as exploitability, impact, exposure, likelihood of abuse, affected assets, and potential consequences for users, clients, and business operations.

• Critical vulnerabilities receive highest priority.
• Assessment of confidentiality, integrity, and availability impacts.
• Evaluation of exploit complexity and attack requirements.
• Consideration of affected users and systems.
• Risk-based remediation planning.

Communication & Coordination

Effective communication helps ensure that reported vulnerabilities are handled efficiently and responsibly. Digital 2Moro seeks to maintain reasonable communication with researchers throughout the review process when contact information has been provided.

• Acknowledgment of valid vulnerability submissions.
• Status updates where appropriate.
• Requests for clarification when additional information is needed.
• Coordination regarding remediation and disclosure timelines.
• Professional and respectful engagement with researchers.

Coordinated Disclosure

Digital 2Moro supports coordinated disclosure practices that balance transparency with the need to protect users and systems from exploitation. Public disclosure before remediation may increase risk and potentially expose users, clients, or operational systems to harm.

We encourage researchers to work with us to establish reasonable timelines that allow vulnerabilities to be investigated and addressed before public disclosure occurs.

• Collaboration between researchers and Digital 2Moro.
• Reasonable remediation windows before public disclosure.
• Protection of users and systems during remediation.
• Responsible communication of vulnerability information.
• Support for transparency after remediation where appropriate.

Legal Considerations

Digital 2Moro expects security research to be conducted lawfully and responsibly. Researchers are responsible for ensuring their activities comply with applicable laws, regulations, contractual obligations, and ethical standards.

This Responsible Disclosure Policy does not grant authorization to access systems, data, networks, or resources beyond what is permitted by applicable law and explicit authorization.

• Compliance with applicable laws and regulations.
• Respect for privacy and confidentiality obligations.
• Avoidance of unauthorized access activities.
• Protection of client and third-party systems.
• Responsible and ethical testing practices.

Client Systems & Third-Party Assets

Many Digital 2Moro solutions are developed and managed on behalf of clients. Client-owned systems, applications, infrastructure, and services may be subject to separate security programs, contractual arrangements, disclosure processes, or ownership requirements.

Vulnerabilities affecting client-owned systems should be reported through appropriate channels and may require coordination with the affected client organization.

• Respect for client ownership and governance requirements.
• Coordination with affected parties when necessary.
• Protection of client confidentiality and security interests.
• Compliance with contractual obligations.
• Support for responsible vulnerability management.

Continuous Security Improvement

Responsible disclosure contributes directly to the ongoing improvement of Digital 2Moro's security posture. Vulnerability reports, security reviews, assessments, monitoring activities, and lessons learned help us strengthen controls, improve processes, and reduce future risk.

• Review of reported vulnerabilities and trends.
• Improvement of security controls and procedures.
• Enhancement of monitoring and detection capabilities.
• Strengthening of development and operational practices.
• Continuous maturation of our security program.

Researcher Recognition

Digital 2Moro appreciates the efforts of individuals who invest time and expertise in identifying and responsibly reporting security issues. While we do not currently operate a formal bug bounty program, valid reports that contribute meaningfully to improving security are valued and appreciated.

• Recognition of constructive security research.
• Appreciation for responsible vulnerability reporting.
• Encouragement of ethical security collaboration.
• Support for long-term engagement with the security community.
• Commitment to improving security through collaboration.

Contact Information

If you believe you have identified a security vulnerability affecting Digital 2Moro systems, services, websites, applications, APIs, or infrastructure, please contact us through our official communication channels and provide sufficient information to assist with investigation and remediation.

We appreciate responsible disclosure efforts that help us maintain a secure environment for clients, users, partners, and stakeholders while supporting our commitment to continuous security improvement.

• Use official Digital 2Moro communication channels.
• Provide detailed and accurate vulnerability information.
• Include contact information for follow-up communication.
• Allow reasonable time for investigation and remediation.
• Work collaboratively toward responsible resolution.