Security
disclosure.

This policy covers security reports sent to Hackicker and our own disclosures to software maintainers. You can report issues in hackicker.com or other systems we operate, as well as issues involving the infrastructure and web applications covered by our research.

Email security@hackicker.com. Include the affected system or component, its version if known, a description of the issue, and steps to reproduce it. Explain the potential impact and include supporting evidence from authorized testing. Plain text is welcome.

Share reports privately so we can assess the issue and coordinate a response.

We acknowledge reports within 48 hours and provide an initial assessment within 7 days. We will tell you whether the issue is confirmed, needs more information, or is outside our scope.

For confirmed issues, we will share a fix plan and target disclosure date, then provide updates until the issue is resolved.

We report vulnerabilities we find to the relevant maintainer privately, including a patch when we can provide one. Our default disclosure window is 90 days from acknowledgment. We may agree with the maintainer to publish sooner or allow more time.

If a maintainer stops responding and the window expires, we publish the finding and explain the disclosure timeline.

We will not take legal action against researchers who act in good faith and follow this policy. Test only systems you own or have permission to test. Do not access, change, or delete other people's data. Limit testing to what is needed to demonstrate the issue, and report it promptly.

This commitment applies to Hackicker. It does not grant permission to test another organization's systems.

Our machine-readable contact details are available in security.txt. The file lists our reporting address, preferred language, and an expiry date for the contact record.