Security & Privacy

In scope

• +https://unpwned.io and https://www.unpwned.io, including same-origin first-party API routes
• +Authentication, session management, and account authorization tested only with accounts you control
• +UNPWNED-side GitHub OAuth token handling, excluding GitHub systems and infrastructure
• +Scan result and report access controls tested only with data you created
• +UNPWNED database authorization and row-level access-control bypasses demonstrated with your own test data

Out of scope

• -Customer domains, scan targets, public reports, or any asset not owned and controlled by UNPWNED
• -demo.unpwned.io, other UNPWNED subdomains not expressly listed above, and third-party services or infrastructure
• -Denial of service, resource exhaustion, destructive testing, malware, or persistence
• -Social engineering, phishing, physical attacks, credential stuffing, password spraying, or brute force
• -Spam, bulk or fake account creation, payment testing, and rate-limit or security-control evasion
• -Automated or high-volume scanning unless UNPWNED gives prior written authorization

Rules of engagement

• ›Use only accounts and data you own or have created for testing, and identify those test accounts in your report.
• ›Use the minimum number of requests and the least data necessary to confirm the vulnerability. Stop after establishing a reproducible proof of concept.
• ›If you encounter another person’s data, stop immediately. Do not copy, retain, alter, download, or disclose it, and notify us without delay.
• ›Do not establish persistence, move laterally, exfiltrate data, modify or delete records, access secrets, interrupt service, or degrade another user’s experience.
• ›Do not evade a suspension, IP block, rate limit, or other security control by changing accounts, identities, networks, tooling, or infrastructure.
• ›Do not use a report or vulnerability to threaten, extort, demand payment, or seek commercial leverage.
• ›Report privately and coordinate public disclosure with us. We normally ask for up to 90 days from acknowledgment to investigate and remediate, unless we agree otherwise or disclosure is legally required.

Conditional safe harbor

When research is conducted in good faith, remains within the scope above, follows every rule in this policy, and complies with applicable law, UNPWNED considers that research authorized by UNPWNED. We will not initiate civil action or ask law enforcement to investigate you for accidental, good-faith violations of this policy.

This authorization is limited to systems UNPWNED owns and controls. It cannot authorize testing of customer or third-party assets, bind any third party, provide immunity from applicable law, or protect bad-faith conduct. If you are unsure whether an action is permitted, email us and obtain written authorization before proceeding.

Abuse response and enforcement

Activity outside this policy is not authorized. Depending on intent, impact, repetition, and attempts to evade controls, UNPWNED may throttle or block access, revoke sessions and API credentials, suspend or terminate accounts without prior notice, preserve relevant security evidence under our Privacy Policy, notify affected infrastructure providers, and pursue civil remedies or refer suspected criminal activity to the appropriate authorities.

A person affected by an automated block may request human review at [email protected]. Repeated testing after a block or suspension, or returning through a new account or network to evade enforcement, is not treated as good-faith research.

What to include in your report

• 1.Description of the vulnerability and its potential impact
• 2.Steps to reproduce (or a proof-of-concept)
• 3.The affected URL, endpoint, or component
• 4.Your name or handle for acknowledgment (optional)