Pre-launch draft — not approved for public launch. Operator details, contact channels and described workflows require verification. This page does not submit a complaint or security report.

Responsible Vulnerability Disclosure

How security researchers can report vulnerabilities to Sobuh safely and responsibly.

1. What to Report

Report suspected vulnerabilities such as authentication bypass, authorization flaws, IDOR, payment verification issues, exposed secrets, data leakage, account takeover risk, XSS, SSRF, injection, insecure storage, or other security issues.

2. Safe Research Rules

Do not access, modify, delete, or exfiltrate user data. Do not disrupt service, spam users, bypass payment flows for gain, attempt social engineering, or run destructive tests. Stop testing after proving the issue safely.

3. Report Contents

Include affected URL or API, steps to reproduce, impact, screenshots or logs with sensitive data redacted, account used for testing, timestamp, and contact details.

4. Contact

Use the published security contact as the placeholder security contact until the final security mailbox and response process are approved. Sobuh should acknowledge valid reports and provide status updates through a tracked case workflow.