RESPONSIBLE VULNERABILITY DISCLOSURE POLICY
Last updated: November 13, 2026

We thank everyone who helps keep Ciberkit secure.

1. HOW TO REPORT
Write to [SECURITY EMAIL] with:
- A description of the vulnerability and its impact.
- Steps to reproduce it and, if possible, a proof of concept.
- The affected URL or component and the date of testing.
We will reply within 5 business days.

2. SCOPE
- The Ciberkit web application and its API (/api/*).
- The account flow: sign-up, sign-in, MFA, password recovery and plans.

3. OUT OF SCOPE
- Third-party services (Supabase, Vercel, Lemon Squeezy, Google, Resend) unless the flaw is in our integration.
- Denial of service, load testing or massive brute force.
- Social engineering and physical attacks.
- Automated scanner reports without demonstrated impact, missing headers without practical impact, or software versions without an exploitable vulnerability.

4. RULES
- Only use your own test accounts; do not access, modify or delete other users' data.
- Stop testing as soon as you demonstrate impact.
- Do not disclose the issue publicly until we have fixed it or 90 days have passed since your report.

5. OUR COMMITMENT
If you follow these rules, we will not take legal action over your research, we will keep you informed about the fix and, if you wish, credit you publicly. We do not offer monetary rewards at this time.