Vulnerability Disclosure Policy

1. Introduction

The security of our systems and the protection of data are our top priority. We welcome the support of independent security researchers to identify and resolve potential vulnerabilities in our IT systems and web applications.

2. Code of Conduct for Researchers

When investigating our systems, you commit to the following conduct:

• Avoid disruptions to operations, degradation of service quality, as well as deleting, altering, or publishing data.
• Do not perform Denial-of-Service (DDoS) attacks, spam campaigns, social engineering, or phishing attacks.
• Limit your analysis to the absolute minimum necessary to demonstrate a vulnerability (Proof of Concept). Do not access third-party user data.
• Keep discovered vulnerabilities confidential and allow us a reasonable amount of time (in accordance with Coordinated Disclosure) to resolve the issue before publishing information about it.

3. Safe Harbor (Legal Protection Statement)

If you conduct security research in good faith ("Good Faith") and strictly adhere to the requirements of this policy, we consider your actions authorized under criminal and civil law and will not take legal action against you or file a criminal complaint.

4. No Financial Rewards (Bug Bounty)

We operate a responsible disclosure program to receive security reports, but not a commercial bug bounty program. We do not offer financial compensation, bounties, or any other reimbursement of expenses for reporting vulnerabilities.

5. Reporting Channel

Please submit your report using our encrypted security contact form or via encrypted email to: security@hotsplots.com.