Vulnerability disclosure policy

Scope

In scope: this site, the subdomains we run, and the one function behind the emergency form.

fulklabs.com

The site and every page on it, including the Arabic tree.

*.fulklabs.com

Any subdomain we operate. Unsure whether one is ours? Ask before you touch it.

/api/submit

The endpoint the emergency form posts to. How it validates, stores and forwards a submission.

Out of scope: our suppliers' own products and infrastructure. Cloudflare, Microsoft and Resend each run a disclosure program. A flaw in one of theirs is theirs, not ours.

Also out of scope: anything needing physical access to us. Social engineering of our people. Denial of service. A scanner's output sent on with nothing behind it.

What we ask

• Test against your own data and your own submissions. Never somebody else's.
• Stop at proof. Enough to show the problem, and no further in than that.
• Do not point automated scanners at the emergency form. Somebody under attack uses that page at three in the morning. Fill it with noise and that is an outage. On the page that can least afford one.
• Do not degrade the service. Do not alter or delete data. Do not copy anything that is not yours.
• Give us a fair chance to fix it before you publish. Tell us when you plan to. We will not argue about the date.
• Keep the finding between us until then.

Safe harbour

Follow this policy and act in good faith. We treat your research as authorized. We will not pursue legal action over it. We will not ask anyone else to.

Break something by accident while inside this policy? Tell us. Saying so is not what gets a researcher into trouble. Not saying so is.

This safe harbour is ours to give. It covers only us. If your testing reaches somebody else's systems, their rules apply, not these.

How to report

Email contact@fulklabs.com, in English or Arabic, whichever you write faster. Include as much of this as you have.

• What the issue is, and the exact page or endpoint.
• The steps to reproduce it, in order.
• What you were able to see or do as a result.
• Anything that helps us see it too: a request, a screenshot, a short recording.

/.well-known/security.txt

The machine-readable version of this page, if that is how you found us.

What to expect

We acknowledge every report that reaches us. Then we tell you whether we could reproduce it. What we make of it. When it is fixed.

We do not run a paid bounty. Want credit for a report? Say so and you will have it.

This is a small firm. A reply comes from a person, not a queue. A hard problem may take a while to close. You will not be left wondering which it is.