CTIF

Security

Reporting a vulnerability

If you have found a security problem in CTIF, send it to support@orvteam.com. This address is monitored ahead of normal support. The same contact is published in machine-readable form at /.well-known/security.txt.

Include what you did, what happened, and enough detail to reproduce it. We acknowledge reports within 2 business days, tell you what we found, and let you know when it is fixed. We will not take legal action over research carried out under the rules below, and we are happy to credit you publicly if you want that.

Rules for testing

  • Test against your own account and your own data only.
  • No denial of service, no load testing, no spam, and no attacks against the sensors themselves: they are production collection hosts and noise you generate becomes data our customers pay for.
  • If you reach customer data, stop, do not download more than the minimum needed to prove the issue, and say so in the report.
  • Give us a reasonable window to fix the issue before publishing.

How the service is built

  • Traffic is served over HTTPS only. The feed backend is not exposed to the internet: it is reachable only from the application on the same host.
  • Passwords are stored hashed, never in plain text, and are never written to logs or support tickets.
  • Each account holds one personal API key that carries its plan and quota. You can rotate it yourself from Settings at any time, which immediately invalidates the old one. Treat a blocklist URL that embeds the key as a credential.
  • Plan, quota and feature checks happen server-side in a single enforcement point, so a crafted request cannot reach data your plan does not include.
  • Payments are made directly to a wallet address shown at checkout and confirmed on-chain. We never ask for a private key, a seed phrase or card details, and we never take custody of anything beyond the payment itself.

What we ask of you

Use a unique password, rotate your API key if it may have leaked, and scope the blocklist URL to the firewall that needs it. If you think your key has been used by someone else, rotate it first and then write to us: the request log tells us what was fetched with it.

Related

Data handling, retention and GDPR rights are in the privacy policy. Service health is on the status page, and non-security questions belong on the support page.