책임 있는 취약점 공개
Neurako 학습자들과 그들의 학습 데이터를 안전하게 지키는 데 도움이 되는 선의의 보안 연구를 환영해요.
01. 제보 방법
Email reports to [email protected] with the subject prefix [SECURITY].
If you send proof-of-concept requests to our systems, include the HTTP header X-Neurako-Security-Research: [email protected] so we can distinguish testing from abuse in logs.
Include the affected URL or API endpoint, steps to reproduce, impact, screenshots or request/response snippets when useful, and whether you want public credit.
02. 대상 범위
- Neurako web app: app.neurako.com
- Neurako marketing site: neurako.com and www.neurako.com
- Neurako iOS and Android applications
- Neurako-owned API endpoints used by the apps
- Access-control, authentication, payment-accounting, storage, and user-data issues
03. 대상 외 범위
- Denial-of-service, spam, phishing, or social-engineering tests
- Physical attacks, employee targeting, or attempts to access employee accounts
- Automated scanner output without a reproducible security impact
- Reports for third-party services unless they directly affect Neurako users
- Issues requiring compromised devices, rooted devices, or user-installed malware
04. 조사 규칙
Use your own accounts and test data. Do not access, modify, delete, or exfiltrate data that does not belong to you. Stop testing and report immediately if you encounter another user's data.
Keep testing low volume, avoid persistence, and do not publicly disclose a vulnerability before we have had a reasonable opportunity to fix it.
05. 보상이 아닌 인정
We do not currently operate a bug bounty program and cannot offer monetary rewards, swag, or other compensation for reports.
For valid, helpful reports, we can offer public credit in a Hall of Fame entry or security blog article if you want to be named.
06. 대응 일정
We aim to acknowledge security reports within 48 hours.
We aim to provide an initial triage decision within 5 business days and will share material remediation updates when a report is valid and actionable.