Security & Vulnerability Disclosure Policy

At Opak Cellar, the privacy of our customers and the security of our online store are top priorities. While our storefront is hosted on a secure, PCI-DSS compliant platform, we recognize the important role that security researchers and the cybersecurity community play in keeping the internet safe. 

If you believe you have discovered a potential security vulnerability in our systems, we encourage you to notify us responsibly.

How to Report a Vulnerability
Please email your findings directly to our team:
* Primary Security Email: jake.lo@opakcellar.com
* Supported Languages: Traditional Chinese, English

Disclosure Guidelines
To help us investigate and resolve the issue quickly, please include the following in your report:
1. Detailed Description: Clear steps to reproduce the vulnerability, including URLs, IP addresses, affected parameters, or proof-of-concept (PoC) code.
2. Data Protection: Do not attempt to access, modify, download, or destroy customer personal data or store records.
3. Reasonable Timeframe: Allow us a reasonable amount of time to review, patch, and address the reported issue before making any public disclosure.
4. Good Faith: Act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services.

What You Can Expect
* Acknowledgment: We will aim to acknowledge receipt of your report within 2–3 business days.
* Investigation: We will investigate the reported issue and provide status updates as necessary.
* Remediation: Once verified, we will work promptly to resolve or mitigate the vulnerability.