Security Policy and Vulnerability Reporting

• Write to us at zmentaro@gmail.com. This address is also published in security.txt, in line with RFC 9116.
• Describe the issue, the affected address (URL), the steps to reproduce it and the possible impact. A screenshot or a minimal example helps.
• Write in Romanian or English.

• We confirm receipt within 5 business days at most.
• We keep you informed about our analysis and the fix.
• If you wish, we thank you publicly once the issue is fixed. We do not currently have a monetary reward programme.

• Test only with your own accounts and do not access, change or delete other people's data. If you come across personal data, stop and tell us.
• Do not attempt denial-of-service (DoS) attacks, social engineering, phishing or physical attacks.
• Do not run automated scanners that put load on the server.
• Keep the issue confidential until we fix it, or for no more than 90 days from your report, unless we agree otherwise.

If you follow the rules above and act in good faith, we consider your research authorised, we will not file a complaint against you over it, and we will work with you to understand and fix the issue. However, we cannot waive the rights of third parties and we cannot guarantee the decisions of the authorities.

Reports that only say a header is missing, with no demonstrated impact; issues in old or unsupported browsers; unfiltered automated reports; and attacks that require physical access to the victim's device.