Security and responsible disclosure

Report a potential issue

Send a concise report to info@rihuum.net with the subject ‘Security report’. Include the affected domain or product, the observed behaviour, safe reproduction steps, impact and a way to contact you. Do not include live credentials, unnecessary personal data or publicly disclose the issue before Rihuum has had a reasonable opportunity to assess it.

Safe research boundaries

Rihuum welcomes good-faith reporting but does not authorise unrestricted security testing through this page.

• Do not access, modify, delete, download or retain another person’s data.
• Do not use denial-of-service, social engineering, physical attacks, spam, malware or automated traffic that degrades service.
• Stop when you have enough evidence to describe the issue; do not establish persistence or pivot to other systems.
• Obtain written authorisation before testing client environments, private portals, third-party systems or production Agentic AI tools.

What happens next

Rihuum will triage the report, protect evidence, assess scope and prioritise remediation according to risk and operating impact. Response timing depends on severity, reproducibility, affected parties and available contact details.

A report is not a guarantee of payment, public credit or a specific resolution date. Any recognition or coordinated disclosure will be agreed explicitly.

Operational security

Rihuum’s engineering standard includes least privilege, protected configuration, supported dependencies, versioned releases, security review, monitoring, tested backup and recovery, incident handling and documented product retirement. These are continuing requirements; publication of this statement is not a certification.

Sentinel AI and SecureTrack scope

Rihuum Sentinel AI Cybersecurity Suite and SecureTrack AI follow controlled product-definition, threat-modelling, privacy, anti-abuse and release-gate processes. The 40-module register is an architecture and maturity map, not a deployment or certification claim. Testing or use requires verified authority over the relevant device, account, network or asset.

Public and low-risk discovery services may begin on shared hosting. Real device telemetry, background events, privileged actions, sensitive security records and evidence-vault operations require stronger isolated infrastructure, protected secrets, monitoring, queues, tested backup and recovery before a controlled pilot.