Vorlaxen // Vulnerability Disclosure Program

Try to break in.

No architecture details, tech stack revelations, or internal logic are shared. If you find a security flaw within the rules below, report it.

PGP Fingerprint:

Public Key (.txt)|security.txt

C009 644E A884 DD13 B711 2366 6D3E EB46 8E20 23A9

Submit Report Rules Safe Harbor Hall of Fame

[+] In-Scope Vectors

Authentication & Session Bypasses
Session expiration bypass, token forgery, privilege escalation, or unauthorized access to other accounts.
Cryptographic & Hash Tampering
State forgery, breaking signature integrity, or circumventing hash chains.
Race Conditions & Concurrency
Simultaneous state mutations, double-spending tokens, or out-of-order execution leading to unauthorized state.
Injection & Remote Code Execution
SQL/NoSQL injections, path traversal, or remote command execution across exposed APIs.
Business & Authorization Logic Flaws
Direct object references (IDOR), unauthorized setting changes, or subverting workflow rules.

[-] Out-of-Scope Actions

Volumetric Network DDoS
Flooding raw bandwidth, SYN floods, UDP amplification, or link saturation.
Social Engineering & Phishing
Phishing staff, spear-phishing, spoofing employee identities, or physical intrusion.
Third-Party Upstream Providers
Attacking third-party hosting, DNS root, cloud infrastructure, or external provider endpoints directly. Our own API integration points, webhook endpoints, and data processing layers that communicate with external providers are strictly in-scope.
Data Destruction & Ransom
Wiping databases, holding systems for ransom, or destroying user data. Proof-of-concept demonstrations only.
Noisy / Blind Automated Scanners
High-volume, indiscriminate automated scans that exceed rate limits or exhaust server resources. Controlled, targeted, and rate-limit compliant automated testing tools and scripts are fully permitted.

Bounty Status: There is currently no monetary bounty reward program. In-scope, verified findings are granted Safe Harbor legal protection and public attribution on the Hall of Fame.

Legal Protection (Safe Harbor Agreement)

If a researcher complies with the terms below, Vorlaxen recognizes all testing activities as authorized, good-faith security research. Vorlaxen commits not to pursue civil lawsuits or criminal complaints (including computer misuse statutes, unauthorized data access laws, and criminal property damage):

Testing exclusively within the declared in-scope targets and using your own dedicated test accounts/data,
Not intentionally compromising, modifying, deleting, or degrading user data or production services,
Reporting vulnerabilities exclusively to security@vorlaxen.com without unauthorized prior disclosure until a mutual agreement is reached.

This agreement and all security research activities conducted hereunder are governed by and construed in accordance with the laws of the Republic of Turkey. Istanbul Courts and Enforcement Offices have exclusive jurisdiction.

Vorlaxen shall not be liable for any indirect, punitive, or consequential damages (including hardware degradation, local ISP penalties, or operational costs) incurred by the researcher during testing. Testing is undertaken at the researcher's sole discretion.

Data Privacy & Personal Data (GDPR / KVKK)

If testing inadvertently leads to exposure of production user personal data or credentials:

Downloading, copying, retaining, altering, or sharing exposed personal data is strictly prohibited. Local testing logs may only be retained to the extent strictly required to assemble the disclosure advisory and must be wiped post-remediation.
Demonstrate the vulnerability using the absolute minimum necessary evidence (e.g., masked screenshots).
Notify the Vorlaxen security team immediately and permanently purge any local cached copies.

Coordinated Disclosure Process

1. Initial Triage (48 Hours)

Reports are acknowledged and assigned to a security engineer within 48 business hours.

2. Verification & Scoring (5 Business Days)

Findings are validated against our test environment, and appropriate severity/CVSS rating is determined.

3. Remediation Window (30-90 Days)

Patches are deployed within 30 days for Critical/High issues and up to 90 days for lower-severity findings.

4. Coordinated Release & Attribution

Upon deployment of the fix, the researcher is added to the Hall of Fame, receives an official Digital Certificate of Recognition, and is credited in security release advisories. Unless otherwise agreed in writing, technical write-ups may be published after this stage.

Hall of Fame

Security researchers with verified findings in our defense perimeter:

No verified reports submitted yet.