Responsible Disclosure
We take the security of our systems seriously. If you believe you have found a vulnerability, please tell us so we can fix it.
How to report
Email [email protected] with a clear description of the issue. Please include:
- the affected URL, system, or component;
- step-by-step instructions or a proof of concept to reproduce it;
- the impact as you understand it; and
- how we can reach you for follow-up questions.
Reports can be written in English or Ukrainian. Please do not include sensitive personal data beyond what is needed to demonstrate the issue.
What to expect
We will acknowledge your report within 3 business days. We will keep you informed as we investigate and fix the issue, and we ask that you give us reasonable time to do so before sharing details publicly.
Scope
In scope: websites and services operated by AmonSul under the amonsul.tech domain.
Out of scope:
- denial-of-service testing and volumetric attacks;
- social engineering or phishing of AmonSul staff, clients, or partners;
- physical attacks against offices or equipment;
- vulnerabilities in third-party services we use (report those to the vendor); and
- automated scanner output submitted without a demonstrated impact.
Machine-readable policy
Our security.txt follows RFC 9116.