Vulnerability disclosure
Security & disclosure
How to report a vulnerability, what we commit to, and the machine-readable policy behind this page.
Report a vulnerability
Send a private email with the affected URL, a short description, and steps to reproduce. Do not include third-party personal data or attach exploits that could harm someone else.
Email the security teamcontact@izkuna.site · We aim to acknowledge valid reports within 2 business days.
In scope
- The public Izkuna website and the authenticated client portal.
- Authentication, sessions, and payment flows.
- Exposed configuration or data that could affect clients.
Out of scope
- Denial-of-service, social engineering, or physical access.
- Third-party services Izkuna does not operate.
- Automated scans that degrade availability.
What happens next
-
01
Acknowledgement
We confirm receipt and assign a tracking contact.
-
02
Assessment
We reproduce the issue and agree on a disclosure timeline.
-
03
Resolution
We fix, verify, and credit valid reports if you want to be named.
Safe harbor
We will not pursue legal action for good-faith research that follows this policy, stays within scope, and avoids privacy violations or service disruption.