Vulnerability reporting and responsible disclosure policy
Dear users and visitors,
onlybio regards the protection of its users' personal data and account security as one of its most fundamental priorities. Our platform operates on an infrastructure that has been designed in line with current security standards and is regularly audited and continuously improved. Nevertheless, mindful that no software system is entirely free of errors, we attach great importance to transparent and constructive cooperation with security researchers and our users.
What should you do if you find a vulnerability?
Should you discover any security vulnerability on our platform, a flaw that allows unauthorized access, a data leak, or any weakness that could disrupt the normal operation of the system, we kindly ask that you report it to our team without delay and exclusively via the email address below:
[email protected]To enable a prompt and accurate assessment of your report, it is essential that it include the following information:
- The type of vulnerability and the page, URL or feature it affects;
- A step-by-step description of how the vulnerability was discovered and how it can be reproduced;
- Screenshots or technical details constituting a proof of concept, if available;
- Your assessment of the potential impact of the vulnerability on users or the system.
Every report we receive will be examined thoroughly, and confirmed vulnerabilities will be remedied as quickly as possible. Individuals who submit a report in good faith and in accordance with this policy will, upon request, be awarded the Bug Hunter badge for display on their profile.
Rules to be observed
To ensure that the responsible disclosure process functions properly, persons submitting reports must comply fully with the following rules:
- The vulnerability must not be shared with any third party, group, forum or social media platform until it has been fixed by our team and written permission for its public disclosure has been granted.
- No action may be taken beyond the minimum necessary to confirm the existence of the vulnerability; accounts belonging to other users must not be accessed, and their data must not be viewed, modified, deleted or copied.
- If any data is inadvertently accessed through a vulnerability, it must be deleted immediately and permanently and must not be retained or used in any way.
- No attempts at overloading (DDoS), automated mass scanning, social engineering or physical attacks that jeopardize the availability of the system may be made.
- No financial demands may be made in exchange for a report, and no language involving blackmail or threats may be used.
Misuse and legal proceedings
The misuse of discovered security vulnerabilities or obtained data for purposes such as personal gain, harming other users, disrupting the operation of the platform, or disclosing or selling data is strictly unacceptable.
Should such actions be detected, the accounts and IP addresses of the persons involved will be permanently banned without prior notice; system logs, IP addresses and all other technical evidence will be preserved and shared with the competent authorities. Furthermore, a criminal complaint will be filed and all necessary legal proceedings will be initiated against those responsible under all applicable legislation, in particular Articles 243, 244 and 245 of Turkish Penal Code No. 5237, which govern cybercrime, and the Personal Data Protection Law No. 6698. We reserve the right to exercise our legal rights to claim compensation for any pecuniary and non-pecuniary damages that may arise.
Persons who act in accordance with this policy and report a vulnerability in good faith will not be subject to any legal action on account of limited testing carried out solely for the purpose of reporting.
We thank you for your contribution towards building a secure platform and are grateful in advance for your understanding and cooperation.
Kind regards,
The onlybio Team