Security Reports Policy

1. How to report

Email [email protected] with a clear, reproducible writeup. The faster we can triage, the faster we can fix. Include:

• Exact reproduction steps (request/response, HAR, or a short PoC script).
• The commit hash shown in the page footer when the issue was observed.
• Your suggested CVSS vector, or a written impact assessment.
• Whether you would like to be credited on the Acknowledgements page — and under what handle.

We acknowledge legitimate reports within 72 hours. Triage / fix timeline scales with impact: critical issues are fast-tracked; lower-severity findings ship in the next regular release.

2. Scope

In scope

• https://mop.dev — public web app and authenticated user areas.
• https://api.mop.dev — HTTP API surface.
• https://cdn.mop.dev — static assets (report integrity / supply-chain issues here, not content).
• Auth, session, password-reset, OAuth, and admin-privilege flows across all three.
• Logic bugs that compromise integrity, confidentiality, or availability of user data.

Out of scope

• Embedded third-party services — Cal.com, OpenStreetMap tiles, Google Fonts, unpkg / jsDelivr CDNs, Stripe, Satispay. Report those to their vendors directly.
• Social-engineering or phishing of staff or users.
• Denial-of-service tests, traffic floods, or resource-exhaustion against production.
• Brute-forcing real user accounts. Use accounts you control.
• Missing security headers / cookie attributes on endpoints that don't handle credentials, when no exploitable impact is demonstrated.
• Self-XSS that requires the victim to paste attacker-supplied content into their own devtools.
• Reports generated solely by automated scanners with no triage or verification.

3. AI-assisted reports

AI tooling is welcome on our side of the table — provided a capable human supervises every step. We strongly recommend you double-check and strictly supervise any AI usage before sending a report. Concretely:

• Reproduce the issue yourself, end to end, before submitting. Do not rely on an LLM's claim that a vulnerability exists — verify it on a real request.
• Read and understand the code or behavior the AI flagged. A signed-off report means a human, not the model, vouches for the finding.
• Strip hallucinated CVE IDs, fabricated commit references, made-up function names, and confident-but-wrong CVSS vectors. These waste triage time and erode trust.
• If the report is largely AI-drafted, say so. Transparency is appreciated; concealment is not.

Reports that are clearly unverified LLM output — boilerplate vulnerabilities that don't apply, copy-pasted scanner noise, hallucinated impact — will be closed without further correspondence. If you are not in a position to verify the finding yourself, please do not send it.

This is not anti-AI — we use AI tooling extensively in development. It's a quality bar: the human is accountable for what the machine produces.

4. Disclosure expectations

• Give us a reasonable disclosure window before going public — typically 90 days, sooner if we ship the fix first and you confirm it.
• Don't access, modify, or exfiltrate data that isn't yours. If you stumble across user data while reproducing, stop and tell us.
• Don't run automated scanners against /api/*. The IP-based governor will rate-limit you and obscure real findings. Manual probes are fine.
• Don't post the issue publicly, on Twitter/X, GitHub, or a writeup site before we've coordinated disclosure.
• One issue per report. Chained bugs are fine; unrelated bugs in the same email are not.

5. Safe harbor

If you operate in good faith within this policy — staying within scope, avoiding data access beyond what's necessary to demonstrate impact, and coordinating disclosure — we will not pursue or support legal action against you for the research, and we will work in good faith to resolve the issue.

This is a statement of intent, not a contract; we cannot waive rights of third parties, and obvious bad-faith actions (data theft, extortion, attacks on availability) are not covered.

6. Compensation

We do not currently run a paid bug-bounty program. Researchers who report responsibly are credited on the Acknowledgements page (with consent) and can request a written reference for portfolio purposes.