1. How to report
Write to serviceinfoclub@gmail.com. Include:
- what the vulnerability is and where: the page or request URL;
- steps to reproduce, so we can repeat it;
- the possible impact: which data or actions are at risk;
- your contact details for a reply.
Write in Ukrainian or English.
Scope: the infoclub.ai website and its services. [to clarify: which subdomains are in scope].
2. What is allowed during research
- test only on your own accounts created for the research;
- use only test data, not real people's data;
- stop as soon as you have confirmed the vulnerability;
- if you accidentally see someone else's data, do not keep it or share it, and tell us right away.
3. What is not allowed
- accessing, changing or deleting other members' data;
- denial-of-service (DoS) attacks and load testing;
- social engineering against members and the INFOCLUB team;
- physical access to offices, servers or team devices;
- spam through website forms, the bot or email;
- publishing details of a vulnerability before we have fixed it.
4. What we promise
If you follow these rules, we:
- confirm receipt of your report within […];
- keep you informed: assessment, plan and when it is fixed;
- do not take legal action or go to law enforcement over good-faith research within these rules.
5. Rewards
There are no cash rewards for found vulnerabilities (bug bounty) yet. If a programme appears, we will update this document.
6. security.txt
Contacts for vulnerability reports are also published in a machine-readable format (RFC 9116): https://infoclub.ai/.well-known/security.txt
How the platform itself is protected is described on the Platform Security page.