Security Policy Overview

This security policy outlines the security support commitments for different types of Ory users.

Apache 2.0 License users

• Security SLA: No security Service Level Agreement (SLA) is provided.
• Version Support: Security patches are only provided for the current release version.

Ory Enterprise License customers

• Security SLA: The following timelines apply for security vulnerabilities based on their severity:
  • Critical: Resolved within 14 days.
  • High: Resolved within 30 days.
  • Medium: Resolved within 90 days.
  • Low: Resolved within 180 days.
  • Informational: Addressed as needed.
• Release Schedule: Updates are provided as soon as vulnerabilities are resolved, adhering to the above SLA.
• Version Support: Depending on the Ory Enterprise License agreement, multiple versions can be supported.

Ory Network users

• Security SLA: The following timelines apply for security vulnerabilities based on their severity:
  • Critical: Resolved within 14 days.
  • High: Resolved within 30 days.
  • Medium: Resolved within 90 days.
  • Low: Resolved within 180 days.
  • Informational: Addressed as needed.
• Release Schedule: Updates are automatically deployed to Ory Network as soon as vulnerabilities are resolved, adhering to the above SLA.
• Version Support: Ory Network always runs the most current version.

Reporting a Vulnerability

Please read the following section to learn more about reporting security vulnerabilities at the Ory Bug Bounty Program.

Ory Bug Bounty Program

Ory is working with Hackerone to provide a private bug bounty program for all Ory products. If you are interested in joining the program, please create an account at Hackerone and request access. The following is the policy for the private bug bounty program.

Being a security-focused company, Ory appreciates, encourages, and rewards feedback from the security community. Ory is open source at heart, so feel free to inspect our source code. Ory commits to following HackerOne's vulnerability disclosure guidelines and we ask you to do the same. Thank you for helping keep Ory and our users safe!

Research Guidelines

While security-testing Ory systems, please make a good-faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Interact only with accounts you own or with the explicit permission of the account holder.

Prohibited activities:

• Creating failing/incomplete subscriptions to paid plans in Ory Network with incomplete or fake credit card information.
• Social engineering like phishing, vishing, or smishing.
• Security scanning with more than 5 QPS against Ory domains.
• Any activity that leads to disruption of the Ory Network service for customers.

What Can You Report

Please report any potential security vulnerability that potentially leads to sensible exploits. Please report vulnerabilities in Ory's upstream dependencies to the respective projects and only reach out to us if the report to upstream was unsuccessful.

When reporting vulnerabilities, please consider the attack scenario, exploitability, and security impact of the bug. Out of scope are attacks:

• Through the runtime environment of self-hosted Ory installations
• Through user-provided configuration
• Through port address translation for Ory Network Projects
• Around missing rate limiting
• On intentionally public hosts and information on them like documentation and website
• That require physical access to the victim's computer
• Against vulnerabilities in outdated browsers
• Based on software version disclosure or similar issues
• Based on tabnabbing or open redirect unless you can demonstrate an additional security impact
• That require unlikely user interaction
• Disclosing configuration and paths without the required proof of credential leakage

Please use Ory's customer support channels if you need help tuning Ory components for security or if you need help applying security-related updates.

How to Report

Submit one vulnerability per report unless you need to chain vulnerabilities to achieve impact. Please provide a detailed vulnerability report with step-by-step instructions to reproduce the issue. Only vulnerabilities that we can reproduce are eligible for a reward.

Rewards

While all reward decisions are up to our discretion, we generally award these monetary bounties:

We also award swag for smaller findings related to Ory's use of third-party software and services.

Publication

Please do not discuss any vulnerabilities, even resolved ones, outside this program without written consent from Ory.

Safe Harbor

Any activities conducted in compliance with this policy will be considered authorized conduct and not result in legal action from Ory against you.