Vulnerability Disclosure Policy

Scope

This policy covers security vulnerabilities in Hack4Shell-operated public services, including hack4shell-ctf.vercel.app, its public website, and the Hack4Shell platform APIs and features hosted on that domain. Test only accounts and data you own or have explicit permission to use.

Third-party services, hosting providers, social platforms, other users' accounts or data, and systems not operated by Hack4Shell are out of scope. CTF challenge targets are intended for the challenge itself; do not use them to access other systems or data.

Safe harbor and testing rules

We consider security research conducted in good faith and in accordance with this policy to be authorized. We will not pursue or support legal action for accidental, good-faith violations of this policy, and we will work with researchers to understand and resolve reports.

• Make a reasonable effort to avoid privacy violations, service disruption, and data modification or destruction.
• Do not access, copy, retain, or disclose other users' data. Stop testing and report immediately if you encounter it.
• Do not perform denial-of-service testing, social engineering, phishing, or physical attacks.
• Do not publicly disclose a vulnerability before coordinating with us and allowing a reasonable opportunity to address it.

How to report

Email hacker0x09@proton.me or use our security report form. You can also find our reporting contact in security.txt.

Include the affected URL or component, a clear description of the issue, its potential impact, and safe, reproducible steps or a proof of concept. Redact personal or sensitive data from any evidence. We will acknowledge reports and provide updates as our investigation progresses; response and resolution times depend on complexity and risk.

We may publicly recognize researchers on the Hall of Fame with their permission. Tell us whether and how you would like to be credited.