Vulnerability disclosure policy

If you find a security problem in gravexlabs.dev, we want to hear about it.

How to report

Email security@gravexlabs.dev with:

• What you found and where
• The steps to reproduce it
• What an attacker could do with it

Our contact details are also published at /.well-known/security.txt.

What we will do

• Confirm we received your report within 3 working days
• Tell you whether we can reproduce it and what we plan to do
• Tell you when it is fixed
• Credit you if you want, once the fix is live

Rules for testing

• Test only gravexlabs.dev. Our clients' systems are not in scope.
• Do not run denial of service attacks or automated scans that flood the site.
• Do not read, change or delete data that is not yours. If you reach someone else's data, stop and report it.
• Do not use social engineering against our team.
• Give us a reasonable time to fix the problem before you publish it. We ask for 90 days.

Safe harbour

If you follow these rules and act in good faith, we will not take legal action against you or ask anyone else to.

Rewards

We do not run a paid bug bounty. We do say thank you, in public if you like.