سياسة الإفصاح الأمني

1. Protecting Users

We invest in securing accounts, payments, and personal data. External researchers help us identify issues we might miss.

2. Good-Faith Collaboration

We treat valid reports seriously and aim to acknowledge them promptly.

3. No Retaliation for Research

Researchers following this Policy receive safe harbor from platform legal action related to their testing.

4. Employee Reporting

Employees must use internal channels for vulnerabilities discovered during work.

1. In-Scope Assets

Primary web application at uigol.com, official mobile applications, and documented API endpoints are generally in scope.

2. Out-of-Scope Assets

Third-party services, user-generated phishing pages, and unrelated subdomains not operated by UIGOL are out of scope unless they directly compromise platform data.

3. Physical and Social Engineering

Physical attacks, social engineering of employees, and denial-of-service tests are prohibited without prior written authorization.

4. Mobile المنصة Stores

Reports affecting app store distribution channels should note bundle ID and version number.

1. Contact Channel

Email [email protected] with subject "Security Report" and encrypt sensitive details if possible using our published PGP key when available.

2. Required Information

Include sufficient detail for reproduction without excessive exploitation.

• Description of vulnerability and potential impact.
• Steps to reproduce with proof-of-concept if available.
• Affected URLs, parameters, or account types.
• Your contact information for follow-up.

3. One Report Per Issue

Submit separate emails for unrelated vulnerabilities to streamline triage.

4. Language

Reports in English are processed fastest; other languages may require additional translation time.

1. Authorized Testing

Test only against accounts you own or explicit permission targets. Do not access other users' data.

2. Data Handling

Do not exfiltrate personal data beyond minimal proof. Delete copies after verification.

3. Disclosure Timeline

Do not publicly disclose vulnerabilities until we confirm remediation or agree on coordinated disclosure timing.

4. Legal Safe Harbor

We will not pursue legal action against researchers who comply with this Policy and applicable law.

5. Automated Scanning Limits

Low-rate automated scanning on production may be tolerated; aggressive scanning is prohibited.

1. Low-Impact Findings

Missing security headers without demonstrated exploit, descriptive error messages, and self-XSS may be closed as informational.

2. Spam and Rate Limits

Issues without security impact such as email volume limits may not qualify for rewards.

3. Known Issues

Duplicates of already reported and tracked vulnerabilities may receive acknowledgment only.

4. Clickjacking on Non-Sensitive Pages

Clickjacking without demonstrated account takeover may be informational only.

1. Hall of Fame

With permission, we may credit researchers in a security acknowledgments page.

2. Bounty Program

Monetary bounties, if offered, depend on severity and are granted at UIGOL's sole discretion.

3. Policy Changes

We may update scope and rules; the version date reflects current terms.

4. Emergency Contact

For critical active exploitation, mark email as URGENT and include indicators of compromise.

5. Tax on Bounties

Researchers receiving payments are responsible for applicable tax reporting.