Responsible Disclosure Policy

Security is foundational to ZishanHack. We welcome responsible security research conducted in good faith and are committed to reviewing all legitimate vulnerability reports promptly.

✓ In Scope

✗ Out of Scope

• Denial of Service (DoS/DDoS) attacks
• Social engineering or phishing
• Third-party services & integrations
• Physical security attacks
• Automated scanning that impacts availability

• No data exfiltration or copying of sensitive information
• No modification or deletion of user data
• No persistence mechanisms, shells, or backdoors
• Stop immediately upon accessing sensitive data
• Do not impact availability or degrade performance

Submit all vulnerability reports to:

Acknowledgement target: Within 5 business days

We publicly recognize researchers who responsibly disclose valid security vulnerabilities in compliance with this policy.

Hall of Fame inclusion requires: valid non-duplicate vulnerability, full policy compliance, and no premature disclosure.

Public disclosure is permitted only after we have provided written confirmation that the vulnerability has been fully remediated. We request coordinated disclosure to protect our users and infrastructure.