Researchers must follow responsible disclosure practices. Do not exploit vulnerabilities beyond what is necessary to demonstrate the issue. Do not access, modify, or delete data that does not belong to you. All testing must be conducted within the defined scope.

All information about vulnerabilities discovered must be kept confidential until authorized for disclosure. Do not share details about vulnerabilities with third parties without explicit permission. Researchers agree to destroy all data collected during testing once the engagement is complete.

Researchers must stay within the defined scope of the program. Testing methods that could impact system availability or data integrity are prohibited unless explicitly authorized. Automated scanning tools must be used responsibly to avoid system degradation.

Researchers who comply with these terms will receive legal safe harbor for their security research activities. This protection is limited to activities that conform to these guidelines. Any activities outside the scope or in violation of these terms are not protected.

We provide support for researchers through dedicated channels. Questions about scope, testing methods, or report submissions can be directed to our researcher support team. We aim to respond to all inquiries within 24 business hours.

All vulnerability reports must be submitted through the researcher portal. Reports should include clear steps to reproduce, potential impact, and any relevant screenshots or proof of concept code. For critical vulnerabilities, please use the emergency contact method provided in the portal.