# Security policy for smmscout.com

## Reporting

Report vulnerabilities privately to contact@smmscout.com or via the Telegram
channel https://t.me/smmscout. Do not open public issues for security
vulnerabilities.

## Scope

- https://smmscout.com and https://smmscout.pages.dev (HTML, JS, CSS, data API)
- The SMMScout D1-backed functions under /api/* and /go/*
- Associated Workers (uptime alert, Turnstile siteverify)

Out of scope: third-party panels listed in the directory, Cloudflare
infrastructure itself.

## What we would like from you

- A private, minimal proof of concept: payload, affected URL, impact.
- A reasonable disclosure window (30 days default) before public discussion.

## What we promise

- Acknowledgment within 5 working days, with a fix timeline.
- Public credit unless you prefer anonymity.

## Safe harbor

Good-faith testing on your own accounts or the public site (no brute forcing,
no denial of service, no exfiltration of personal data, no data destruction)
is permitted and will not be pursued legally.

## Updates

This policy is updated at https://smmscout.com/security-policy.txt.