Vulnerability Disclosure

We take reports about security problems in our systems seriously

If you have found a vulnerability, we would rather hear about it from you than from an attacker. This page describes how to reach us, what we consider in scope, and what you can expect from us in return.

This page is the policy referenced by our security.txt.

Reporting a vulnerability

Send your report by email to ops[BITTE-LÖSCHEN-SPAMSCHUTZ]@[BITTE-LÖSCHEN-SPAMSCHUTZ]hackingcult.de.

If the report contains sensitive details, please encrypt it with our S/MIME certificate found here: smime.crt

Encrypted mail is welcome, but plain mail is fine too. Do not let missing crypto stop you from reporting something urgent.

We read and reply in English and German.

What to include

A good report lets us reproduce the issue without a lot of back and forth:

• The affected host, URL, or endpoint
• A description of the vulnerability and its impact
• Step-by-step instructions to reproduce it, including requests, payloads, or a short proof-of-concept
• Any relevant logs, screenshots, or HTTP traces
• The date and time (with timezone) of your testing, and the source IP you tested from, so we can match it against our logs
• How you would like to be credited if we publish an acknowledgment

Scope

The hackingcult.de domain and every subdomain under it are in scope. If it answers on a *.hackingcult.de name, we want to hear about it.

Out of scope:

• Anything not served under hackingcult.de. Including our published source code, repositories, and packages hosted elsewhere
• Third-party services we merely use, unless the flaw is caused by our configuration of them
• Findings that only affect outdated browsers or clients
• Missing hardening headers, cookie flags, or TLS configuration with no demonstrable impact
• Findings from automated scanners or AI agents. This tooling is not permitted against our systems in the first place, see the rules of engagement below
• Rate limiting, brute force, and account enumeration on endpoints where this is an accepted trade-off
• Social engineering of our staff, users, or providers
• Physical attacks against our systems or offices
• Spam, SPF/DKIM/DMARC policy opinions without a working spoofing proof
• Denial of service, volumetric testing, and resource exhaustion

Rules of engagement

While testing, please:

• Stay within the scope above
• Use only your own accounts and test data
• Stop as soon as you have confirmed a vulnerability. Do not pivot further into the system
• Do not access, modify, download, or delete data that is not yours. If you encounter third-party data, stop, do not save it, and tell us in your report
• Do not degrade, disrupt, or interrupt our services. Keep request rates low enough that a normal user would not notice you. If you are unsure whether something will hold up under your testing, ask us first
• Test manually. Automated scanners, fuzzers, crawlers, and AI agents that act on their own are not permitted against our systems. Tooling that you drive and observe request by request like an intercepting proxy, a manual request repeater, is fine. Unattended tooling that generates traffic on its own is not
• Do not deploy backdoors, persistence, or leave test artifacts behind. If you had to create something, tell us so we can clean it up
• Keep the details confidential until we have agreed on a disclosure date with you

What to expect from us

We will tell you how we classified the issue and why. If we disagree with your assessment, we will explain our reasoning rather than simply closing the report.

We do not set a fixed embargo period. We would rather agree on a disclosure date with you, per report, based on how bad the bug is and how long the fix realistically takes. Serious issues get fixed quickly and can be published quickly. Something obscure that needs a rewrite may take longer. Tell us early what your own timeline looks like. If you plan to publish on a particular date, or present at a conference, let us know in your first mail and we will work toward it.

Safe harbor

If you follow this policy in good faith, we will treat your work as authorized security research. We will not pursue legal action against you, and we will not report you to law enforcement, for activity that stays within the rules above.

If a third party takes action against you over research that complied with this policy, we will make it known that your activity was authorized.

This is a statement of our own intent. It cannot waive the rights of third parties, and it does not override applicable law. Please act accordingly.

Safe harbour applies only to activity that follows this policy. Automated scanning, AI-driven testing, and anything that puts the availability of our systems at risk falls outside it. We treat that as unauthorized access to our infrastructure and reserve the right to pursue it accordingly, including by referring it to law enforcement.

Rewards

There is no bug bounty here. We do not pay for reports, and we are not going to pretend otherwise.

What you get instead: a human reply from someone who understands what you sent, a real fix rather than a ticket that rots, an honest explanation if we decide not to fix something, and public credit on this page in whatever form you prefer.

Acknowledgments

Thanks to the people below for reporting security issues to us responsibly. Just tell us in your report if you would like to be listed or would rather stay anonymous.

No reports published yet