security

Security Policy Overview

This security policy outlines the security support commitments for different types of Ory users.

Apache 2.0 License users

• Security SLA: No security Service Level Agreement (SLA) is provided.
• Version Support: Security patches are only provided for the current release version.

Ory Enterprise License customers

• Security SLA: The following timelines apply for security vulnerabilities based on their severity:
  • Critical: Resolved within 14 days.
  • High: Resolved within 30 days.
  • Medium: Resolved within 90 days.
  • Low: Resolved within 180 days.
  • Informational: Addressed as needed.
• Release Schedule: Updates are provided as soon as vulnerabilities are resolved, adhering to the above SLA.
• Version Support: Depending on the Ory Enterprise License agreement multiple versions can be supported.

Ory Network users

• Security SLA: The following timelines apply for security vulnerabilities based on their severity:
  • Critical: Resolved within 14 days.
  • High: Resolved within 30 days.
  • Medium: Resolved within 90 days.
  • Low: Resolved within 180 days.
  • Informational: Addressed as needed.
• Release Schedule: Updates are automatically deployed to Ory Network as soon as vulnerabilities are resolved, adhering to the above SLA.
• Version Support: Ory Network always runs the most current version.

Reporting a Vulnerability

Please read the following section to learn more about reporting security vulnerabilities at the Ory Bug Bounty Program.

Ory Bug Bounty Program

Ory is working with Hackerone to provide a private bug bounty program for all Ory products. If you are interested in joining the program, please create an account at Hackerone and request access. The following is the policy for the private bug bounty program.

Being a security-focused company, Ory appreciates, encourages, and rewards feedback from the security community. Ory is open source at heart, so feel free to inspect our source code. Ory commits to following HackerOne's vulnerability disclosure guidelines and we ask you to do the same. Thank you for helping keep Ory and our users safe!

Research Guidelines

While security-testing Ory systems, please make a good-faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Interact only with accounts you own or with the explicit permission of the account holder.

Prohibited Activities:

• Creating failing/incomplete subscriptions to paid plans in Ory Network, for example with incomplete or fake credit card information.
• Social engineering like phishing, vishing, or smishing.
• Security scanning with more than 5 QPS against Ory domains.
• Any activity that leads to disruption of the Ory Network service for customers.

What Can You Report

Please report any potential security vulnerability that could lead to sensible exploits. Please report vulnerabilities in Ory's upstream dependencies to the respective projects and only reach out to us if the report to upstream was unsuccessful.

When reporting vulnerabilities, please consider the attack scenario, exploitability, and security impact of the bug.

Out of scope are attacks:

• Through the runtime environment of self-hosted Ory installations
• Through user-provided configuration like a user not setting appropriate permissions on projects containing sensitive information
• Through port address translation for Ory Network Projects
• Around missing rate limiting (we have it on our roadmap)
• On intentionally public hosts and information on them like our documentation and website
• That require physical access to the victim's computer
• Against vulnerabilities in outdated browsers (more than two versions behind the latest stable version)
• Based on software version disclosure, banner identification issues, descriptive error messages or headers (stack traces, application or server errors)
• Based on tabnabbing or open redirect unless you can demonstrate an additional security impact
• That require unlikely user interaction.
• Disclosing configuration and paths unless you include proof of credential leakage or demonstrate an attack with the leaked information (since we manage much of our infrastructure through public GitOps repositories)

Please use Ory's customer support channels if you need help tuning Ory components for security or need help applying security-related updates.

How to Report

Submit one vulnerability per report unless you need to chain vulnerabilities to achieve impact.

Please provide a detailed vulnerability report with step-by-step instructions to reproduce the issue. Only vulnerabilities that we can reproduce are eligible for a reward.

Rewards

While all reward decisions are up to our discretion, we generally award these monetary bounties out of our total yearly bounty budget for security vulnerabilities that we can reproduce:

We also award swag for smaller findings, like problems with Ory usage of third-party software and services for marketing, email, or developer support.

When receiving multiple reports about the same issue, we award the first report that we can fully reproduce. Multiple vulnerabilities caused by the same underlying issue result in only one bounty. We award public Zero-day vulnerabilities that have had an official patch for less than one month on a case-by-case basis.

Publication

Please do not discuss any vulnerabilities, even resolved ones, outside this program without written consent from Ory.

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and will not result in legal action from Ory against you. If you face legal action in connection with activities conducted under this policy, Ory will take steps to make it known that you conducted your actions in compliance with this policy.