We use cookies to improve your experience on our website. By browsing this website, you agree to our use of cookies.
Security and Trust
How we protect CloudScript, OpsScript and the environments we operate for our clients, and how to report a vulnerability.
Accountable executive
The security program has a formal owner who answers for it to clients, partners and authorities.
Gustavo Henrique Esser
Chief Information Security Officer (CISO)
Accountable for the information security program, incident response and LGPD compliance at CloudScript and OpsScript.
Reference framework: NIST CSF 2.0
We organize the program around the six functions of the NIST Cybersecurity Framework 2.0. It is our governance reference, not a certification.
Govern
A formal accountable executive, versioned policies and recorded risk decisions. Every production change goes through human review.
Identify
Asset inventory per client and environment, with findings ranked by severity and split between production and non-production.
Protect
Least privilege, read access scoped per environment, secrets in a dedicated manager and never in code, versioned images and changes through GitOps.
Detect
Cloud, edge, cluster and pipeline alerts centralized in OpsScript, with 24/7 monitoring by the NOC.
Respond
Incident triage and investigation with a full trail in the ticket. Fixes applied by engineers through Pull Requests, with a rollback plan.
Recover
Defined database backups, restore procedures and lessons learned recorded after every incident.
Responsible disclosure policy
If you found a vulnerability in a CloudScript or OpsScript system, we want to hear about it. Please follow the rules below.
Scope
- cloudscript.com.br and its subdomains
- opsscript.io, the OpsScript web application and API
- The OpsScript mobile apps
- CloudScript public repositories
What we ask you not to do
- Access, modify or keep third-party data beyond the minimum needed to demonstrate the issue
- Denial-of-service tests or anything that degrades availability
- Social engineering, phishing or physical access
- Test CloudScript client environments, which are out of scope
- Disclose publicly before we have had reasonable time to fix it
Our commitment
- Acknowledge receipt of your report
- Keep you informed about the analysis and the fix
- Treat your report confidentially
- Publicly credit the finding, if you wish
We consider good-faith research within this policy to be authorized, and we will not take legal action against anyone who follows it. We do not run a bug bounty program.
Report a vulnerability
Send a description, steps to reproduce and the observed impact. This channel is read by the security team.
