Vulnerability Disclosure Policy

Introduction

KUTIM-CSIRT is committed to keeping the electronic systems of the East Kutai Regency Government secure. We recognize that security researchers and the public may discover vulnerabilities, and we appreciate disclosure done responsibly.

This policy explains which systems are covered, the testing that is permitted, the safe harbor assurance for good-faith reporters, and how to submit a report to us.

Scope

This policy applies to official digital assets of the East Kutai Regency Government:

• Websites and applications on the *.kutaitimurkab.go.id domain.
• Information systems and electronic services owned or managed by the East Kutai Regency Government.

Services owned by third parties outside the control of the East Kutai Regency Government are not included in this scope. If you are unsure whether a system is covered, please ask KUTIM-CSIRT first before testing.

Testing Guidelines

Permitted:

• Non-destructive testing limited to what is needed to prove the vulnerability exists (proof of concept).
• Using only your own accounts and data.

Prohibited:

• Denial-of-service attacks (DoS/DDoS) or testing that places excessive load on systems.
• Damaging, altering, or deleting data; disrupting service availability.
• Accessing, downloading, or storing personal data or confidential information beyond what is needed to prove the vulnerability. If you accidentally access such data, stop, do not store or share it, and report it immediately.
• Social engineering, phishing, or fraud against employees or users.
• Physical attacks against offices, hardware, or infrastructure.
• Publishing vulnerability details before they are fixed and without KUTIM-CSIRT's approval.
• Exploiting a vulnerability for personal gain or to harm others.

Safe Harbor — Protection for Good-Faith Reporters

KUTIM-CSIRT considers security research conducted in good faith and in compliance with this policy to be a legitimate and beneficial activity.

• We will not pursue or recommend legal action against reporters who discover and report vulnerabilities in accordance with this policy.
• If any other party objects to such activities, KUTIM-CSIRT will state that the reporter acted in accordance with the applicable policy.

This safe harbor applies as long as the reporter complies with all provisions of this policy and applicable laws and regulations. Violating the testing guidelines may void this protection.

How to Report

Submit vulnerability findings through one of the following channels:

• The Report Incident form — choose the “Security Vulnerability” category. You will receive a ticket number to follow the progress.
• Email csirt@kutaitimurkab.go.id. For sensitive information, use PGP encryption (the public key is available on the Contact page).

So that we can follow up quickly, please include:

• A description of the vulnerability and its type.
• Steps to reproduce the issue.
• The potential impact it may cause.
• The affected system, application, or URL.
• Supporting evidence such as screenshots (without other people's personal data).

Our Commitments & Expectations of Reporters

What you can expect from KUTIM-CSIRT:

• Acknowledgement of receipt within 3 working days at the latest (see Service Standards). Scores can be calculated with the CVSS calculator. Full workflow: SOP for Handling Vulnerability Reports; form: finding report template.
• Review, verification, and follow-up of valid reports.
• Updates to the reporter on handling progress.
• Recognition of the reporter's contribution.

What we expect from reporters:

• Submitting a clear and actionable report.
• Giving the team reasonable time to fix the vulnerability before disclosing it publicly.
• Keeping vulnerability details confidential until the fix is complete.

Out of Scope

The following findings are generally not considered actionable vulnerabilities:

• Automated scanner output without proof of real impact.
• Missing security headers or best practices without demonstrable concrete impact.
• Issues that can only be exploited through physical access or social engineering.
• Vulnerabilities in third-party services outside the control of the East Kutai Regency Government.
• Clickjacking on pages without sensitive actions, and issues that only affect browsers/versions that are no longer supported.

Reporter Recognition — Hall of Fame

KUTIM-CSIRT thanks the reporters who have helped improve the security of East Kutai Regency Government systems through responsible vulnerability disclosure.

Changes to This Policy

KUTIM-CSIRT may update this policy at any time. The latest version is always available on this page. Questions about this policy can be sent to csirt@kutaitimurkab.go.id.