Responsible disclosure
Security
Testing and disclosure rules — read before any submission.
DisclosureTest scope only
Our virtual staging environments are for testing only. Production infrastructure is never a target.
90-day coordinated disclosure
No exploit publication before fix + written consent. Duplicates are grouped, not penalized.
Privacy
Do not exfiltrate personal data beyond minimal proof. Report and delete.
Critical infrastructure
Security reports are handled by our triage team within 48 h. We neither request nor accept destructive testing.