Last modified: 14th August 2026

Vulnerability Disclosure Policy

At Oi Technologies, we take the security of our users, systems and data extremely seriously. Security vulnerabilities can exist in any software, and we greatly value the security researchers and ethical hackers who help us find and fix them before they can be exploited.

This Vulnerability Disclosure Policy (“Policy”) explains how to report security vulnerabilities in our websites, mobile applications and software services. We encourage responsible disclosure and are committed to working with the security community to protect our users.

Submit a Report Now

1. Scope

This Policy covers all products, services, websites and applications owned, operated or maintained by Oi Technologies, including:

  • Websites: oitech.com.bd and any of its subdirectories or subdomains.
  • Applications: Our apps, software, websites, SaaS products and any future products we release.
  • APIs and backend services: Any APIs or server-side infrastructure that support our services under the domains above.
  • Payment systems: Any payment pages or systems that we operate. The systems of our bank, mobile financial services providers and payment gateway provider are not owned by us and are out of scope.

Out of scope:

  • Third-party websites, applications or services that we link to but do not own or operate.
  • Physical security issues, such as office access.
  • Social engineering attacks, such as phishing, against our team or users.
  • Denial-of-Service (DoS) or Distributed Denial-of-Service (DDoS) attacks.

2. How to Report a Vulnerability

If you believe you have found a security vulnerability in any of our services, please report it to us promptly.

Email: [email protected], or use our Contact Us page. Please put “Security Vulnerability Report” in the subject line.

Please do not disclose the vulnerability publicly or to any third party until we have had a reasonable opportunity to investigate and fix it.

3. What to Include in Your Report

The more detail you provide, the faster we can act. Please include as much of the following as you can:

  • Description: A clear, concise explanation of the issue.
  • Steps to reproduce: Detailed steps that let us replicate it, such as URLs, payloads or test scenarios.
  • Impact: What an attacker could achieve by exploiting it, for example data exposure, privilege escalation or account takeover.
  • Affected systems: The application, version or component involved.
  • Proof of concept (optional but encouraged): Code snippets, screenshots or logs that demonstrate the issue.
  • Your contact details: Your name or alias and an email address, so we can keep you updated.

4. Rules of Engagement

When testing for vulnerabilities, please follow these rules.

You may:

  • Test only on your own accounts, test data or dummy accounts created for testing. Do not target other users’ data.
  • Interact with our systems in a non-destructive way.
  • Use automated scanning tools responsibly, without sending excessive traffic that could affect the availability of our services.

You may not:

  • Access, modify or delete data that does not belong to you.
  • Perform any form of DoS or DDoS attack.
  • Use social engineering, phishing or physical attacks against our team, contractors or users.
  • Exploit a vulnerability beyond the minimum needed to prove it exists. For example, do not download large databases or exfiltrate data.
  • Disclose the vulnerability to any third party before we have resolved it.
  • Violate any applicable law of Bangladesh or your local jurisdiction.

5. Safe Harbor

We are committed to protecting security researchers who act in good faith. If you report a vulnerability to us in line with this Policy, we will not take legal action against you or ask law enforcement to investigate you, provided that you:

  • Follow the guidelines in this Policy.
  • Do not intentionally harm our systems, data or users.
  • Do not exploit the vulnerability for personal or financial gain.
  • Give us a reasonable amount of time to fix the issue before any public disclosure.

This Safe Harbor does not apply if you break the law or the rules of engagement in this Policy.

6. Our Process and Timeline

When you submit a report, we will:

  1. Acknowledge your report within 48 hours.
  2. Verify the issue, confirm it is valid and assess its severity (Critical, High, Medium or Low).
  3. Fix it as quickly as possible and keep you updated on progress. We aim to resolve critical vulnerabilities within 7 business days and other issues within a timeframe that reflects their severity.
  4. Disclose in a coordinated way. Once the fix is deployed, we will publicly acknowledge your responsible disclosure in our Transparency Report or a dedicated security acknowledgement page, with your permission.

We ask that you disclose the vulnerability publicly only after we have completed the fix and confirmed to you that it has been deployed.

7. Rewards

Oi Technologies does not currently run a paid bug bounty programme. As a startup, we cannot offer monetary rewards for vulnerability reports.

We do deeply value your contribution, and we will:

  • Publicly acknowledge your responsible disclosure, with your explicit consent.
  • Offer our sincere thanks for helping keep our users safe.

If we introduce a paid bug bounty programme, we will announce it separately.

8. Changes to This Policy

We may update this Policy at any time. When we do, we will update the “Last modified” date at the top of this page. We encourage researchers to review it periodically.

9. Contact Us

For questions about this Policy, write to [email protected] or use our Contact Us page. We aim to acknowledge your query within 48 hours and provide a substantive resolution within 7 business days.

Found something?

Submit a Report Now