Security Vulnerability Disclosure Policy

Overview

ComiCine takes the security of its websites, applications, and services seriously. We welcome responsible security vulnerability reports from independent security researchers.

Reporting Security Vulnerabilities

Please report security vulnerabilities to [email protected]. Where possible, include:

• A clear description of the vulnerability.
• The affected URL, endpoint, or component.
• Steps to reproduce the issue.
• The potential security impact.
• Relevant technical evidence.
• Suggested remediation, if available.

Researchers are not asked to provide personal information beyond what is reasonably necessary for communication.

Scope

Only systems owned by ComiCine and explicitly authorized for testing may be considered potentially in scope. Do not assume that a subdomain, third-party integration, external platform, or connected service is in scope merely because it is associated with ComiCine.

If it is unclear whether a system is in scope, request authorization in writing first. Do not perform active security testing on it unless and until explicit authorization is granted.

Responsible Research Guidelines

Researchers are asked to:

• Act in good faith.
• Avoid accessing, modifying, or deleting other users' data.
• Avoid disrupting services or degrading availability.
• Avoid denial-of-service attacks.
• Avoid phishing, social engineering, and physical attacks.
• Avoid destructive testing.
• Use the minimum testing necessary to demonstrate a vulnerability.
• Stop testing and report immediately if sensitive information is exposed.
• Avoid publicly disclosing unresolved vulnerabilities before coordinating with ComiCine.

This policy does not grant unrestricted authorization to test ComiCine systems. Submitting a report does not authorize further access or testing.

Disclosure Process

1. The researcher submits a report.
2. ComiCine reviews the information provided.
3. ComiCine may request additional technical details.
4. ComiCine investigates the issue and prioritizes remediation.
5. Public disclosure may be coordinated after appropriate remediation.

This process does not promise specific response, remediation, or disclosure deadlines.

Rewards and Compensation

ComiCine does not currently operate a public bug bounty program. Submitting a vulnerability report does not establish eligibility for monetary compensation. No payment, merchandise, employment opportunity, or other reward is promised.

Legal and Authorization Notice

This policy itself does not authorize security testing; testing requires separate, explicit authorization. This policy does not create a legal safe harbor or promise immunity from legal action. Researchers are responsible for ensuring their activities are authorized and comply with applicable laws and relevant service terms. This policy does not permit unauthorized access, privacy violations, or disruptive testing.

Contact

Please contact [email protected].

For information about public recognition, see Security Acknowledgments.