We welcome responsible, good-faith security disclosures that help protect our customers, services and website. This page describes how to submit a private report and the boundaries for safe research.
Scope of responsible reports
Policy status: Approved and in effect. Pingplus Media maintains this policy as an active part of its established governance and daily operating practices. Effective April 11, 2026.
We welcome good-faith reports about our public website, externally exposed APIs, account sessions, access controls, information leakage and related systems that a researcher is legally entitled to inspect. The presence of this page does not establish an unrestricted bug bounty, grant consent for penetration testing or authorise tests against third-party carriers or customer infrastructure.
Safe testing boundaries
Do not attempt denial-of-service traffic, bulk automated scanning, SMS submission, SMPP binds, account takeover, social engineering, persistence, data extraction, credential stuffing, exploitation of third-party services or changes to production data. Stop immediately if unrelated customer records appear. Obtain written permission and an agreed testing window for activity that might affect service availability or traffic.
How to report privately
Contact our team using the contact page with the subject “Security Vulnerability Disclosure”. Include the affected URL/product, steps to reproduce using your own test account, potential impact, timestamps and a safe description of supporting evidence. Avoid supplying private customer information or active secrets; our team can arrange a secure follow-up method for sensitive materials.
Acknowledgement and handling
The assigned security contact assesses reported findings for reproducibility, exploitability, customer impact and operational change risk. The response may involve mitigation, controlled patching, vendor escalation or customer coordination. No guaranteed acknowledgement or remediation deadline is implied unless separately agreed with the reporter in writing.
Coordinated disclosure
Please provide a reasonable opportunity for assessment and remediation before publishing details that could materially harm customers. Public acknowledgements and any disclosure schedule require agreement and must not reveal customer data, internal IP addresses, credentials or confidential vendor arrangements.
For questions about this policy or enterprise service requirements, please contact our team.