Scope
In scope:
- qyneticlabs.com and its subdomains;
- the deployments of this website on vercel.app (qynetic-labs.vercel.app and its preview URLs);
- the website’s API endpoints, including the form endpoint at /api/contact.
Out of scope, unless you can show a real security impact:
- missing best-practice headers or cookie flags (the site sets no cookies);
- the rate limits on our forms, or the ability to send a single unwanted message;
- clickjacking on pages without sensitive actions;
- email configuration findings such as SPF, DKIM or DMARC policy;
- vulnerabilities in third-party services we use, which should be reported to those vendors;
- reports from automated scanners without a verified, exploitable issue;
- denial-of-service, physical, or social-engineering attacks.
Testing rules
When researching, please:
- only use accounts and data that belong to you, and stop as soon as you have shown the issue;
- never access, change or delete data that isn’t yours, and never keep it;
- don’t run denial-of-service attacks or high-volume automated testing, and don’t send spam through our forms;
- don’t use social engineering, phishing or physical attacks against our team or premises;
- keep the details confidential until we have fixed the issue, or 90 days have passed since your report, whichever comes first;
- comply with the law, including the Information Technology Act, 2000.
Response targets
From the time we confirm a report, we aim to fix or mitigate it within:
- Critical: 7 days
- High: 30 days
- Medium: 60 days
- Low and informational: 90 days, or at our next relevant release
Severity is assessed with CVSS v3.1 and agreed with you during triage.
Rewards and recognition
Every valid, original report that leads to a fix earns a place in our Hall of Fame, with a link to your profile if you like. For significant findings we may also offer a reward, decided case by case at our discretion; we don’t publish a fixed price list yet. Duplicates are credited to the first reporter.
Safe harbour
If you research and report in good faith and follow this policy, we consider your work authorised: we will not pursue or support legal action against you for it, and if a third party takes action against you over research that followed this policy, we will make clear that it was authorised.
Hall of Fame
Researchers who have helped keep Qynetic Labs secure. No reports yet: yours could be the first.