Vulnerability disclosure policy

Last updated: 2 November 2026

We teach security, so we take reports seriously. If you find a weakness in the app, this website or our purchase server, please tell us privately first.

1. How to report

Email cybersecprotocol.team@gmail.com with the subject Security report. Include what you found, where, the steps to reproduce it and what an attacker could do with it. Screenshots or a short video help.

2. In scope

• The Cybersec Protocol Android app (package com.cybersec.protocol).
• cybersecprotocol.app and its pages.
• Our purchase server (the endpoints the app calls to redeem codes and check for updates).

3. Rules

• Test only with your own account and devices. Do not access, change or delete other people's data.
• No denial-of-service, spam, social engineering of our team or users, or physical attacks.
• Do not test third-party services we use (Google, Firebase, Cloudflare, Lemon Squeezy, Unity); report issues in them to their own programmes.
• Give us a reasonable time to fix the problem (90 days by default) before telling anyone else.

4. Our promise

• We reply within 5 working days and keep you updated.
• We will not take legal action against research done in good faith under these rules.
• With your permission, we thank you by name in the app's release notes. We are a small team and cannot pay bounties yet.