If you find a security problem on our site, we want to hear about it before anyone else does. We publish a security.txt file under RFC 9116 so a researcher does not have to guess who to email. This post explains what that file says, what we consider fair testing, and where else a Malaysian reporter can go.

What security.txt is

RFC 9116 defines a small, machine-readable text file that a site can publish so that security researchers can find its reporting contact without searching. It was written by Edwin Foudil and Yakov Shafranovich and published as an Informational RFC in April 2022. The file lives at a fixed path, /.well-known/security.txt, so a scanner or a person can always find it at the same place without needing to be told. Ours is at that path today.

There is no Encryption field yet. We have not published a PGP key, so for now a report reaches us as plain email. There is also no Acknowledgments field. We do not run a bug bounty, and we say that plainly below rather than let the absence speak for itself.

Our disclosure policy, in plain words

The scope is otomoai.com.my and app.otomoai.com.my. If you find a genuine security problem in either, here is what we ask and what we promise.

• Do not access, change, or download data that is not yours.
• Do not run denial-of-service tests or social-engineering attempts against our staff.
• Stay inside those limits and report in good faith, and we will not pursue legal action against you for the testing itself.
• We will acknowledge a report within 3 working days.
• Once we have confirmed a report, we fix it within a set time by severity: critical within 7 days, high within 30, medium within 90, low in the next scheduled release.
• If you want credit by name for the find, we will give it once the issue is fixed.

What is out of scope

• Denial-of-service testing of any kind.
• Social engineering aimed at our staff or contractors.
• Physical access to our offices or hardware.
• Third-party services we use, such as our hosting or database providers. Report those to the provider directly.
• Findings on client sites we built. Those sites belong to our clients, and a report about one of them should go to that client, not to us.

What this is not

• It is not a bug bounty. We do not pay for reports, and we do not currently run a rewards programme.
• It is not an audit. We have not paid a third party to test the site against this policy.
• It is not a claim that the site has no bugs. It is a channel for telling us about one, and a promise of how we will respond.

Why this needs written permission at all

Malaysia's Computer Crimes Act 1997 (Act 563) makes unauthorised access to a computer an offence under Section 3, regardless of whether the person accessing it takes anything or causes any damage; the penalty on conviction is a fine of up to RM50,000, imprisonment of up to five years, or both. Testing someone else's systems without permission is not a grey area under Malaysian law. This policy is that permission, but only for the scope, and only inside the rules, set out above. Testing outside those limits is not covered by anything on this page.

Where else to report, in Malaysia

Cyber999 is the national incident reporting service run by MyCERT under CyberSecurity Malaysia. It takes reports from anyone in Malaysia, not just about our site, through an online form, email, phone, or its mobile app. If you would rather not email us directly, or the problem is broader than our site, Cyber999 is the other route.

Sources

• RFC 9116, "A File Format to Aid in Security Vulnerability Disclosure," E. Foudil, Y. Shafranovich, April 2022: the file format, the fields, and the fixed path. https://www.rfc-editor.org/rfc/rfc9116
• securitytxt.org: the problem security.txt solves for independent researchers. https://securitytxt.org/
• MSC Malaysia, "Computer Crimes Act 1997 (Act 563)": Section 3 summary and penalty. https://www.msc.com.my/cyberlaws/computer-crimes-act.html. The Attorney General's Chambers Laws of Malaysia portal (lom.agc.gov.my) and two legal mirrors (commonlii.org, sherloc.unodc.org) were tried for the primary statute text and could not be retrieved (blocked or unavailable on every attempt, checked 14 September 2026); the section and penalty above are cited from this secondary summary instead.
• MyCERT, Cyber999 reporting channel: contact methods and hours. https://www.mycert.org.my/cyber999