Responsible Disclosure

Overview

DevPass is committed to maintaining the security of our platform and the data our users entrust to us. We value the work of security researchers and welcome reports of potential vulnerabilities.

This policy outlines the guidelines for reporting security issues and our commitment to working with researchers responsibly and transparently.

Scope

This policy applies to security vulnerabilities found in:

• devpass.com and all subdomains.
• The DevPass API and backend services.
• The DevPass mobile application (when released).
• Our official open-source repositories.

How to Report

To report a security vulnerability, please email us at:

devpassofficial@gmail.com

For sensitive reports, you may request our PGP key for encrypted communication.

Please do not report security issues through public channels, GitHub issues, social media, or community forums.

What to Include

A good vulnerability report includes:

• Description: Clear description of the vulnerability and its potential impact.
• Steps to reproduce: Detailed steps to reproduce the issue, including URLs, parameters, and request/response details.
• Proof of concept: Screenshots, videos, or code snippets that demonstrate the vulnerability.
• Severity assessment: Your assessment of the severity (Critical, High, Medium, Low).
• Suggested fix: If you have a recommendation for remediation, include it.
• Your contact information: How we can reach you for follow-up questions.

You do not need to provide a fix — we appreciate reports that clearly demonstrate the issue.

Response Protocol

When you submit a report, here is what to expect:

Our full response process:

1. Acknowledgment: We will acknowledge receipt of your report within 48 hours.
2. Assessment: Our team will evaluate the vulnerability and classify its severity within 7 business days.
3. Remediation: We will work to resolve confirmed vulnerabilities as quickly as possible, with a target of 30 days for critical issues.
4. Disclosure: We will coordinate with you on public disclosure timing. We ask that you do not disclose the vulnerability publicly until we have had time to address it.

Safe Harbor

We support safe harbor for security researchers who follow this policy. If you make a good-faith effort to comply with this policy:

• We will not pursue legal action against you for your research activities.
• We will not report your activities to law enforcement.
• We will work with you to understand and resolve the issue quickly.
• We will not take any action that would result in the termination of your access to DevPass.

Safe harbor applies to research conducted in accordance with this policy. Activities that go beyond responsible disclosure (e.g., data destruction, service disruption, accessing other users' data) are not covered.

Recognition

We value the contributions of security researchers. With your permission, we will:

• Acknowledge your contribution on our Security page.
• Add your name to our security Hall of Fame (if you opt in).
• Provide a DevPass swag pack for significant findings.

We do not currently offer monetary bug bounties, but we are open to discussing rewards for critical vulnerabilities.

Out of Scope

The following are not considered valid vulnerability reports under this policy:

• Vulnerabilities in third-party services or libraries (report these to the respective vendor).
• Social engineering attacks against DevPass employees or users.
• Physical attacks against DevPass infrastructure or offices.
• Denial of service attacks or testing that degrades platform performance.
• Issues related to email spoofing, SPF, or DMARC records.
• Vulnerabilities that require physical access to a user's device.

Contact

For security reports and questions about this policy:

• Email: devpassofficial@gmail.com
• PGP: Available on request
• General: devpassofficial@gmail.com