← Back to Home
POLICY SPECIFICATION:

Vulnerability Disclosure Policy

Last updated: October 2026 · Scope: *.slcls.dev

Security and privacy are taken seriously across all services under the SLCLS umbrella. If you believe you have found a security vulnerability in any SLCLS systems or services, please report it in accordance with this policy.

Safe Harbor

Activities conducted in good faith and in compliance with this policy will be considered authorized. I will not initiate legal action, pursue civil claims, or request law enforcement investigation against researchers who:

  • Make a good faith effort to avoid privacy violations, data destruction, and interruption of services.
  • Only interact with test accounts or accounts under their own control.
  • Promptly report findings and do not exploit vulnerabilities beyond the minimum necessary to verify their existence (proof-of-concept only).
  • Keep vulnerability details confidential until a mutually agreed remediation window has passed (typically 60–90 days).

Scope

In-Scope Assets

This policy applies to all systems, infrastructure, and web applications owned and operated under the SLCLS umbrella:

  • slcls.dev
  • sentry.slcls.dev
  • review.slcls.dev
  • cdn.slcls.dev
  • Any other hostnames resolving to *.slcls.dev
  • Underlying infrastructure: Cloud VMs, databases, mail routing services, and API endpoints owned and directly configured by SLCLS.

Out-of-Scope Assets

Third-party services, vendors, or upstream providers (e.g., Cloudflare, GitHub, hosting providers) except where an issue stems from an SLCLS-controlled misconfiguration.

Strictly Prohibited Methods

Do not engage in testing that disrupts service availability or targets human beings. The following are strictly forbidden:

  • Denial of Service (DoS/DDoS): Any volumetric, exhaustion, or resource-flooding attacks.
  • Social Engineering: Phishing, spear-phishing, vishing, or pretexting directed at domain contacts or administrators.
  • Physical Attacks: Physical access against servers, data centers, hardware, or property.
  • Data Modification/Destruction: Deleting, exfiltrating, or altering data belonging to others.
  • Spam or High-Volume Automated Scanning: Unthrottled fuzzing, brute-force login attempts, or running automated scanners (e.g., Nessus, Acunetix, Nikto) without manual validation.

Excluded Low-Impact Findings

The following issues are considered low-impact/informational and should not be submitted unless chained into a concrete, reproducible exploit:

  • Missing HTTP security headers (e.g., CSP, HSTS, X-Frame-Options) without a working exploit.
  • Clickjacking on non-sensitive, static, or public-facing pages.
  • Email configuration quirks (SPF/DKIM/DMARC best-practice advisories) without demonstrating unauthorized mail relay or domain spoofing bypassing controls.
  • Missing CAA or DNSSEC records.
  • Banner grabbing or software version disclosure without a verified, unpatched CVE exploit.

How to Submit a Report

Please send findings directly via encrypted or plain email:

What to Include

  1. Target URL, subdomain, or endpoint.
  2. Type of vulnerability (e.g., IDOR, SQLi, SSRF, RCE, logic bug).
  3. Step-by-step reproduction steps and a minimal Proof of Concept (PoC).
  4. Potential security impact.
  5. (Optional) Your preferred name/handle if you wish to be credited.

Rewards & Hall of Fame

This is a personal project operated independently. There is no bug bounty program, and monetary compensation or bounties cannot be provided.

Valid, responsibly disclosed security findings that demonstrate real impact will receive:

  • Prompt acknowledgment and communication during remediation.
  • Public attribution / Hall of Fame recognition (if requested).