How to report a vulnerability in Webraptor, and what you can expect from us in return.

1. Reporting

Email [email protected]. If you need to transmit sensitive material, ask first and we will provide an encrypted channel. Please do not open public issues describing an unpatched weakness.

2. What to include

A clear description of the issue and its impact; reproduction steps or a proof of concept; the affected host or endpoint; whether data was accessed and to what extent; and a contact address for follow-up.

3. Scope

In scope: webraptor.org and its subdomains, the console, the public API, and our published client SDKs.

Out of scope: third-party sites you may capture, denial-of-service and load testing, social engineering of staff, physical access attempts, and findings that require a compromised device or already-stolen credentials.

4. Safe harbour

If you act in good faith, stay within scope, avoid privacy violations and service disruption, and give us reasonable time to remediate, we will not pursue legal action and will not report you to law enforcement for the research itself.

5. Our commitments

We acknowledge reports within two working days, provide an initial assessment within five, and keep you informed until resolution. We aim to remediate confirmed high-severity issues within 30 days.

6. Coordinated disclosure

We ask that you allow 90 days before public disclosure, or longer by agreement where a coordinated fix requires it. We will credit you in the advisory unless you prefer otherwise.

7. Recognition

We do not currently operate a paid bounty programme. Where a finding leads to a material fix we will acknowledge your contribution publicly, with your consent.

8. Contact

[email protected] — monitored during business hours, Central European Time (CET). For an active incident affecting customer data, mark your subject line URGENT.