Security Vulnerability Principles and Testing Rules

Version: V1.0

These Rules take effect on 2026-10-15

The Fygo Security Response Center will revise these Rules as business needs and regulatory requirements change. Revised versions will be published on this page and notified through official channels. Vulnerability reports that have been submitted and remain under review will be assessed and rewarded under the version of the Rules in effect when they were submitted.

If you have any questions about these Rules, you may contact the Fygo Security Response Center. The interpretation and implementation of these Rules shall comply with applicable law and shall not affect any rights you have that cannot lawfully be excluded or restricted.

I. Basic Principles

1. Fygo places great importance on the security of its products and business. Fygo always places user data security, network security, and system stability first.

The Fygo Security Response Center is responsible for receiving vulnerabilities and intelligence relating to the products and related in-house applications and services provided by AXISSTORE TECHNOLOGY PTE. LTD. ("Fygo", "we", "us", or "our"). We welcome white-hat researchers, security organizations, researchers, and others to participate in coordinated security reporting, disclosure, and handling, and to help build a sound Internet security ecosystem.

We sincerely invite security researchers, technology enthusiasts, and developers to participate in building Fygo OS security and to help create a safer and more reliable NAS ecosystem. To thank users who proactively identify and report security issues, threat intelligence, or privacy vulnerabilities to Fygo, Fygo will provide monetary rewards to reporters through its security reporting reward program.

2. We strictly prohibit using vulnerability testing as a pretext to harm user interests, disrupt business operations, steal user data, or use vulnerabilities for coercion or bribery. We will not provide rewards for such conduct and reserve the right to pursue further legal liability.
3. Without coordinating with Fygo, no person may publicly disclose vulnerability or intelligence details before a vulnerability has been remediated or effectively mitigated (including, without limitation, disseminating or discussing vulnerability or intelligence details on third-party platforms), or use a vulnerability for unlawful gain. If you violate this provision, we may cancel the reward for the report and recover rewards already granted. For unlawful conduct, we reserve the right to take further legal action in accordance with law. If you intend to publicly discuss or disclose a vulnerability to any third party after we have remediated it, including through conference presentations or technical articles, please contact [email protected] in advance to coordinate the timing and content of the disclosure and to avoid disclosing user data, active credentials, or other information that still requires protection.
4. If you disagree with a vulnerability rating, you are welcome to provide feedback at [email protected]. Mutual respect and rational communication are prerequisites for resolving issues. We will not provide rewards for conduct such as fabricating facts, maliciously disparaging the Fygo Security Response Center, verbally attacking, abusing, or threatening Fygo Security Response Center personnel, and rewards already paid will be recovered. Thank you for your understanding and cooperation.
5. Rewards you receive by submitting vulnerabilities, security solutions, or similar materials through this Security Response Center may be subject to tax under applicable tax law. You are responsible for fulfilling the tax filing and payment obligations applicable to you. Fygo or the actual payer will perform tax withholding or reporting obligations only where required by applicable law and will pay you the reward after deducting the corresponding tax in accordance with law. To complete legally required payment, tax, or identity verification, you shall provide the necessary information upon reasonable request; relevant personal information will be handled in accordance with the applicable privacy policy.
6. Vulnerability severity and the final reward amount will be assessed comprehensively based on factors including the actual scope of impact, exploitability, impact under default configurations, whether exploitation can be carried out at scale, and report quality. The Fygo Security Response Center reserves the final right to interpret this program.

II. Testing Rules

1. Tests that may cause abnormal business operations are prohibited. Scanners or other automated tools are prohibited; only manual testing is permitted. Any type of denial-of-service (DoS or DDoS) testing, or conduct that generates large volumes of traffic through automated scanning by software or tools, is prohibited.
2. For injection vulnerabilities, reading actual business-table data is strictly prohibited. For injection types such as UPDATE, DELETE, and INSERT, automated tools may not be used for testing. Tests that may alter table data require prior application and written authorization and may use only dedicated test data.
3. Internal-network penetration testing and any harmful testing are prohibited, including but not limited to: using scanners within an internal network after obtaining internal-network access; moving laterally to systems that are not publicly exposed; obtaining access to, or data from, internal applications or hosts; uploading webshells; and establishing reverse shells.
4. Downloading, retaining, or disseminating sensitive business-related data is prohibited, including but not limited to source code, operational data, user information, login credentials, and other data leaked from business servers or platforms such as GitHub. If you unknowingly download such data, you must promptly explain the matter and delete the data. Relevant code or data obtained during testing must be deleted immediately after the SRC confirms the vulnerability and must not be unlawfully retained or used.
5. Non-technical vulnerability testing, such as proximity attacks, physical intrusion by hackers, social-engineering testing, or email phishing, is prohibited. In particular, using illegal means such as social-engineering databases to obtain user passwords is prohibited.
6. Access-control vulnerabilities: please use your own test accounts to verify read access and provide only the test data necessary to demonstrate the unauthorized access. Bulk retrieval or proactive retrieval of real user data is strictly prohibited. Sensitive operations (creation, deletion, or modification) must not involve normal production user accounts. If further proof of impact is needed, please consult the Fygo Security Response Center and conduct testing only after obtaining its consent.
7. It is strictly prohibited to affect real online business operations or user data, or cause user complaints. This includes, without limitation, sending test information to real users through email, mobile phones, social-media accounts, or other channels, or directly contacting real users for testing by telephone, instant messaging tools, or other means.
8. Text, images, or videos that violate Fygo Security Response Center requirements or laws and regulations may not be used as test materials.
9. Before conducting important sensitive operations, please report to the Fygo Security Response Center and obtain authorization before further testing. 9. Before conducting important sensitive operations, please report to the Fygo Security Response Center and obtain written authorization before further testing. Testing must be limited to devices, accounts, and environments that you own or are expressly authorized to use. Active testing of Fygo online services is limited to testing assets that Fygo has expressly published as in scope or separately authorized in writing. These Rules do not authorize testing of third-party systems, other users’ NAS devices, or assets not expressly included in scope. If you are uncertain about the testing scope, please contact [email protected] first.
10. For reports concerning leaked AK/SK credentials, please submit the AK/SK information directly to the Fygo Security Response Center. The Center will verify it and confirm the scope and severity of impact. You are strictly prohibited from independently conducting in-depth business testing to verify impact.
11. Depending on the seriousness of the violation, the following measures will be imposed on persons in violation:

• Cancel the reward for an individual vulnerability/intelligence report and recover rewards already issued.

• Suspend or terminate eligibility to participate in Fygo Security Response Center reward programs.

• Reserve the right to pursue legal liability in accordance with law against conduct that violates applicable computer misuse, cybersecurity, data protection, or other laws and uses security vulnerabilities to cause damage or harm systems and user interests.

• If you disagree with a disciplinary measure, you may appeal through [email protected].

III. Safe Harbor

We advocate and follow a responsible vulnerability disclosure mechanism:

• Do not publicly disclose any vulnerability details.

• Do not use vulnerabilities for any destructive activities.

• Do not disclose user data or affect real production environments.

The Fygo Security Response Center will give full respect and protection to researchers who submit vulnerabilities in compliance with the rules.

For security researchers who follow the rules of this program in good faith, conduct security testing within the authorized scope, and report vulnerabilities promptly, Fygo considers such research authorized and, to the extent within its authority, will not bring or actively support legal proceedings against the researcher on account of that research.

Prerequisites:

• Comply with the Fygo Security Response Center Basic Principles and Testing Rules, and conduct research within the expressly authorized scope.

• Do not maliciously exploit vulnerabilities.

• Do not proactively obtain or disclose user data.

• Do not affect real production environments.

Fygo cannot authorize testing on behalf of third parties and cannot bind law-enforcement authorities or third parties in their legal actions. If a third party takes legal action concerning research that complies with these Rules, we will, to the extent permitted by law, confirm the fact that the research was authorized by Fygo. This provision does not guarantee exemption from liability under applicable law.

Appendix Security Testing Procedures

The following procedures apply together with the main text. For matters involving authorization, data handling, and disclosure, the main text shall prevail.

1. For injection vulnerabilities, it is sufficient to prove that data can be read; reading data in the tables is strictly prohibited. For injection types such as UPDATE, DELETE, and INSERT, automated tools may not be used for testing.
2. Access-control vulnerabilities may be verified only using your own test accounts and test data. Provide the minimum evidence necessary to demonstrate the issue. Bulk retrieval or proactive retrieval of real user data is strictly prohibited.
3. Where accounts can be registered, use only two of your own accounts to verify the vulnerability and do not involve normal production user accounts. For unauthorized creation, deletion, or modification, use your own test accounts. Where accounts cannot be registered, if you obtain the account credentials for the system and verify them successfully, consult the administrator and obtain consent before conducting further security testing.
4. For stored XSS vulnerabilities, the correct approach is to insert a test payload that does not affect others. Pop-up windows are strictly prohibited; console.log is recommended, followed by verification with another account of your own and screenshots as proof. For blind XSS, only domain information may be exfiltrated. After all XSS tests, inserted data must be deleted. If it cannot be deleted, note the insertion point in the vulnerability report.
5. If shell access or command execution is possible, it is recommended that you upload a text file as proof, such as a plain-text 1.php or 1.jsp file, to demonstrate that the issue exists. Do not download or read any source-code files or sensitive files on the server, and do not execute deletion or write commands. If a webshell is uploaded, specify the shell file address and connection password.
6. When testing vulnerabilities such as unrestricted SMS or email sending limits, use only your own test phone numbers and email addresses, use the minimum number of attempts necessary to demonstrate the issue, and obtain the relevant testing authorization in advance. Do not send messages to other people’s real phone numbers or email addresses, and do not conduct bulk sending, harassment, or incur unnecessary charges.
7. Where testing is needed for vulnerabilities capable of automatic propagation and spread, such as social worms, use only secondary accounts isolated from other accounts. Do not use accounts with social relationships, in order to prevent worm propagation.
8. Do not use scanners on website back-end systems or certain private projects.
9. Except in specially approved circumstances, social engineering unrelated to the vulnerability is strictly prohibited, as is internal-network penetration testing.
10. Do not conduct tests that may cause abnormal business operations, such as testing vulnerabilities that can cause denial of service (for example, IIS denial of service) or DDoS attacks.
11. Do not conduct vulnerability research against unauthorized vendors, projects not assigned to you, or lists outside the testing scope. You may contact the administrator to confirm whether an asset is within scope before conducting research; otherwise, the legal risks of unauthorized activity shall be borne by the vulnerability researcher.
12. Database dumping, arbitrarily creating, deleting, or modifying other people’s information on a large scale, scans that may affect service stability, and malicious conduct such as using vulnerabilities for black- or gray-market activities are prohibited.
13. Exposure of sensitive information may create significant risks for users, vendors, and reporters. Retaining or disseminating sensitive business-related data is prohibited, including but not limited to source code, operational data, user information, and other data exposed on business servers or platforms such as GitHub. If such data is unknowingly downloaded, it must be promptly explained and deleted.
14. Comply with computer misuse, cybersecurity, data protection, and other laws applicable to research activities. It is strictly prohibited to use vulnerability testing as a pretext to harm systems or user interests, including extortion, intimidation, or threats to disclose vulnerabilities or data. Disclosure of vulnerability information shall be handled under paragraph 3 of Section I; disclosures required or protected by law are not restricted by these Rules. For unlawful conduct, Fygo reserves the right to take further legal action in accordance with law.