Websites & Web Apps
Assess common application weaknesses, authentication controls, access controls and security configuration.
AUTHORIZED SECURITY TESTING
Find the weakness
before someone else does.
OreFX Studios performs controlled, permission-based security assessments to help teams discover vulnerabilities, understand the risk, and fix what matters.
WEBAPPSVPS / SERVERSAPIsINFRASTRUCTURE
01 — WHY OREFX
Security testing without
the mystery.
We work within an agreed scope, document what we test, and turn findings into practical remediation guidance. No unauthorized access. No vague reports. Just a controlled test with a clear outcome.
02 — SERVICES
Built around your attack surface.
Applications
Review application behavior and security boundaries under an agreed testing scope.
VPS & Servers
Check exposed services, configuration, hardening and other authorized attack surfaces.
APIs & Online Systems
Evaluate API endpoints, authorization, validation and security controls within the approved scope.
Digital Infrastructure
Assess selected infrastructure components and identify practical security improvements.
03 — PROCESS
01
Permission & scope
We define ownership, targets, timing, permitted techniques and testing boundaries before anything begins.
02
Controlled testing
Our team performs authorized security testing designed to identify meaningful weaknesses without unnecessary disruption.
03
Findings & evidence
We document qualifying findings, their impact and the evidence needed to understand the issue.
04
Remediation guidance
You receive clear recommendations so your team can prioritize fixes and improve resilience.
04 — RULES OF ENGAGEMENT
Permission is the first security control.
✓
OreFX only tests systems when the owner has explicitly authorized the assessment.
Every engagement has a defined scope and agreed rules. Unauthorized hacking, credential theft, disruption, persistence, or access to systems outside the approved scope is not part of the service.
05 — RATES
Reward the result.
Agree the rules first.
OreFX uses a vulnerability-based reward model. If a qualifying finding is discovered, payment follows the reward or contract agreed before testing begins.
Vulnerability Rewards
Qualifying findings in scope
DC$20,000+
VPS / Servers
Per authorized host assessment
DC$20,000+
Apps / APIs
Web, mobile & API targets
DC$20,000+
✓
All testing requires explicit authorization. We only test systems you own or have permission to test. Payout terms are agreed in writing before testing begins.
06 — TERMS & CONDITIONS
The agreement
before the test.
1. Authorization requirement
OreFX only tests systems that you own or for which you hold explicit written permission. By requesting an assessment you certify that you are authorized to authorize testing of the target you provide.
2. Scope of work
Every engagement defines the targets, timing, permitted techniques and boundaries in writing before testing begins. We test only the approved scope and do not extend beyond it without your written agreement.
3. Reward & payment
OreFX uses a vulnerability-based reward model. Rewards follow the published rate table and the amount is agreed in writing before testing begins. Payment is due for qualifying, verified findings only, as defined in the engagement contract.
4. Confidentiality
Findings, reports, target details and any client information are kept confidential. Nothing is published or shared with third parties without your written consent, including after the engagement ends.
5. Reporting & evidence
Qualifying findings are documented with impact and the evidence needed to understand them. You receive clear remediation guidance so your team can prioritize fixes.
6. Limitation of liability
An authorized assessment reduces but does not eliminate risk. OreFX is not liable for issues outside the approved scope, and no engagement is a guarantee of absolute security. Testing is performed on a best-efforts basis within the agreed rules.
7. Termination
Either party may terminate an engagement in accordance with the agreed contract. Work already performed up to the date of termination is documented and settled as agreed.
8. Data handling
We use the details you provide (name, contact, target) solely to run and communicate about the requested service. We do not sell or share them beyond what is required to deliver the engagement.
07 — PLATFORM RULES
How we run
engagements.
1. Authorized targets only
Test only the systems listed in your approved scope. Never expand scope, probe adjacent systems, or test targets that are not explicitly agreed — doing so ends the engagement.
2. Prohibited activity
Credential theft, data exfiltration, persistence, disruption, or any technique outside the agreed rules is prohibited. Unauthorized hacking, fraud or illegal activity is not part of the service and may be reported.
3. Engagement conduct
All testing is performed professionally and documented. Findings are reported privately to the client first; public disclosure happens only with written permission and after the issue is resolved.
4. Requests & tickets
All requests go through the contact form or an approved ticket channel. Include your name, a reliable contact, the target, and confirmation that you are authorized to request testing.
5. Reward eligibility
Only qualifying, verified findings within the approved scope are eligible for rewards. Informational or out-of-scope findings may be reported but are not guaranteed a payout.
6. Prohibited uses
Do not use the platform to request testing of systems you do not own, to file fraudulent claims, or to misuse the service in any way. Violations terminate the engagement and may be reported to relevant authorities.
7. Compliance
You agree to comply with all applicable laws governing the systems you ask us to test. By engaging OreFX you confirm you understand and accept these rules.
08 — COMMUNITY
Join the Discord.
Open a ticket.
Questions, scope details or a request to test — the fastest way to reach OreFX is through the Discord server. Open a ticket and we'll take it from there.
Join the server ↗