Vulnerability Disclosure Program

Responsible Disclosure

I value the responsible discovery and disclosure of security vulnerabilities. I encourage ethical security research and review all reports on a case-by-case basis. Researchers with good faith should follow the guidelines below to ensure their submission qualifies and does not invite legal action.

Scope

The scope is divided into Eligible Assets and Ineligible Assets.

Eligible Assets

Ineligible Assets

Out-of-Scope Vulnerabilities

Note: Attacks of such nature will invite strict legal action!

• Social engineering attacks (Phishing, Vishing, etc.)
• Attacks targeting physical infrastructure
• Content spoofing or text injection (unless it allows HTML/CSS mod)
• Clickjacking or missing security headers without impact
• Denial of Service (DDoS)
• Automated scanner reports without PoC
• Self-XSS

Rules of Engagement

• Do not use automated or mass scanning tools that degrade performance
• Do not disrupt or affect other visitors
• Do not exploit vulnerabilities beyond a minimal Proof of Concept (PoC)
• Do not publicly disclose details without explicit written consent
• Do report your findings responsibly

Agreement

I agree to strictly adhere to the rules mentioned for this VDP and will perform responsible disclosure. I understand that going out of scope is illegal and strictly punishable by the law.