Vulnerability Disclosure Policy

Edition: -

This document is published in its current edition. Operator details are shown as "-" until filled in.

Edition: -

We welcome good-faith security research on this website and Galathilion infrastructure. This policy describes what may be tested, how to report a finding and what you can expect.

1. Scope

1.1. This policy covers https://galathilion.ru and its subdomains, and the infrastructure directly serving the site.

1.2. Out of scope: third-party services linked from the site (providers, messengers, CDNs), social networks, and any systems outside Galathilion’s control.

1.3. Testing must be conducted in good faith and without harming site availability or user data.

2. How to report

2.1. Email - (the address is also listed in security.txt). Encrypt your message if a PGP key is published.

2.2. Useful details: vulnerability description, reproduction steps, impact, severity and, where possible, a minimal proof of concept.

2.3. Please do not disclose the issue publicly before coordinated disclosure timing is agreed, and do not use real personal data in a PoC.

3. What we commit to

  • acknowledge receipt within 5 business days;
  • assess the finding and share its status;
  • agree on disclosure timing (usually up to 90 days after acknowledgement);
  • credit you as a researcher if you wish.

4. Safe harbour

4.1. For researchers acting in good faith and within this policy, we will not pursue legal action or involve law enforcement over the research.

4.2. Conditions: stay in scope; do not harm third parties or service availability; do not access or retain user personal data; do not use social engineering against employees; do not destroy or alter data.

4.3. Research that violates these conditions is outside the safe harbour.

5. Out of scope

  • denial-of-service attacks (DDoS) and load testing;
  • spam, phishing and social engineering;
  • attacks on third-party systems or provider infrastructure;
  • physical access and attempts to access other users’ accounts;
  • automated scanning that causes significant load.

6. Rewards

6.1. There is no public bug bounty programme yet. We appreciate researchers and will credit contributions by agreement, but do not guarantee monetary rewards.

7. Miscellaneous

7.1. This policy does not limit rights granted by law.

7.2. Security contact: -; security.txt is available at https://galathilion.ru/.well-known/security.txt.