Security Vulnerability Disclosure Policy

We take the security of our own systems seriously, and we welcome good-faith reports from security researchers and members of the public who believe they have found a vulnerability.

If you report a suspected issue responsibly and in accordance with this policy, we will treat your report as a security matter, investigate it, and work to resolve it. We will not pursue legal action against researchers who act in good faith and strictly within the boundaries described below.

Send reports by email to hello@devbotz.com with the subject line "Security Disclosure". If you normally use encrypted email, tell us and we will arrange a secure channel before you send sensitive details.

Please do not report vulnerabilities through website contact forms, social media, or public posts, and please do not disclose the issue publicly before we have had a chance to investigate and remediate it.

To help us reproduce and prioritize the issue, please include:

• A description of the vulnerability and the potential security impact.
• The affected URL, host, endpoint, or component.
• Clear reproduction steps, including any proof-of-concept request or payload.
• Observed output or evidence, with screenshots or logs where useful.
• Your approximate testing dates and times, and the source IP address used.
• Any suggested remediation, if you have one.
• How you would like to be credited, or a request to remain anonymous.

Please provide only the minimum data necessary to demonstrate the issue. Do not exfiltrate, download, or retain personal information, customer data, or proprietary material.

We aim to acknowledge receipt of a report within a few business days and to provide an initial assessment after triage. Remediation timelines depend on the severity and complexity of the issue, and on third-party dependencies we do not control.

We will keep you informed of meaningful progress and will tell you when the issue has been remediated. We do not operate a paid bounty program, and we do not commit to any specific response or resolution deadline through this page. Any binding service commitment exists only in a signed agreement.

Reports are handled on a confidential basis by our staff and, where necessary, by vendors whose systems are affected.

This policy permits good-faith testing only against systems that DevBotz owns and operates, and only to the extent permitted by applicable law. It does not authorize you to test any other environment.

• Do not test, scan, or attempt to access systems belonging to DevBotz customers, clients, partners, or vendors.
• Do not test third-party services or infrastructure we use, except according to that provider's own policy.
• Do not test against systems for which you do not have authorization from the system owner.
• Do not use another person's account or credentials at any point.

This policy is not a permission letter for any customer environment. Testing of a customer's own systems requires that customer's explicit written authorization.

The following activities are never authorized and fall outside the good-faith protection described in this policy:

• Denial-of-service or stress testing, or any activity that degrades availability.
• Accessing, modifying, deleting, or exfiltrating data that does not belong to you.
• Establishing persistence, backdoors, or shells on any system.
• Social engineering, phishing, or targeting our staff, customers, or suppliers.
• Physical testing, on-site intrusion, or tampering with facilities or equipment.
• Automated scanning at volumes that could disrupt services, or testing that violates any law.
• Public disclosure of a vulnerability, or of any data obtained during testing, without our written consent.

This policy describes our intent to act reasonably toward good-faith researchers. It is not a legal waiver, a release of liability, or a promise of immunity, and DevBotz cannot grant protection from third parties or from law enforcement.

Your testing must comply with all applicable laws. If we determine that a report was not made in good faith, exceeded these boundaries, or involved prohibited activity, we may take appropriate action.

Commonly reported items that we generally treat as out of scope include: reports generated solely by automated scanners without demonstrated impact; missing security headers or best-practice recommendations without an exploitable consequence; social-engineering or phishing simulations; physical access findings; outdated-library notifications without a proof of exploitability; and reports about third-party services, which should be sent to the relevant provider.

See also our Security & Services Disclaimer and Acceptable Use Policy.