Responsible Disclosure

This policy applies to vulnerabilities in NetRisk.io public website and application services.

Send vulnerability reports to security@netrisk.io. Please include:

• Description of the issue.
• Steps to reproduce.
• Affected URL or feature.
• Potential impact.
• Screenshots or proof of concept, if safe.
• Your contact information.

We ask researchers to:

• Avoid accessing, modifying, deleting, or exfiltrating data.
• Avoid disrupting the service.
• Avoid social engineering, phishing, spam, or physical attacks.
• Avoid testing third-party systems that are not owned or operated by NetRisk.
• Report the issue promptly and privately.
• Give reasonable time for review before public disclosure.

Do not perform denial-of-service testing, malware upload or execution, credential attacks, spam or phishing, attacks against users, vendors, or third parties, or attempts to access data that does not belong to you.

NetRisk is currently a free beta, so response times may vary. We aim to review credible reports and prioritize fixes based on severity and risk.

At this stage, NetRisk does not operate a paid bug bounty program. Recognition may be provided at our discretion.

Security reports: security@netrisk.io.