Responsible Disclosure

How to report

Email [email protected] with the subject line starting with “[Security]”. Please include:

• The affected URL, endpoint or feature, and the account role you used (visitor, student, instructor).
• Clear reproduction steps, a proof of concept, and the impact you believe it has.
• Screenshots, request/response samples or a short video where helpful.
• How to contact you, and whether you would like to be credited.

You can write in Arabic or English. Do not share details of the issue publicly or with third parties until we confirm it is fixed.

In scope

• cybera4u.com and www.cybera4u.com — the website, Academy, accounts, checkout and APIs under /api.
• The CTF Arena (ctf.cybera4u.com) platform itself — not the intentionally vulnerable challenges.
• Authentication, session handling, access control (for example paid lessons or other users’ data), payments and file uploads.

Out of scope

• Intentionally vulnerable CTF challenges and lab machines — solve them in the Arena instead.
• Denial of service, load or stress testing, and spam.
• Social engineering, phishing or physical attacks against staff, students or partners.
• Third-party services we use (payment provider, video hosting, email, Cloudflare) — report to the vendor.
• Reports from automated scanners without a demonstrated impact.
• Missing best-practice headers, clickjacking on pages without sensitive actions, self-XSS, logout CSRF, rate limits on non-sensitive forms, and email SPF/DMARC suggestions without an exploit.
• Vulnerabilities that need a compromised device, outdated browser or rooted phone.

Rules of engagement

• Use only accounts you own or test accounts you create. Never access, change or delete other people’s data — stop and report as soon as you see it.
• Do not run automated scans that degrade the service, and keep request volume low.
• Do not pivot into the server, database or internal network beyond what is needed to prove the issue.
• Delete any data you obtained once the report is closed.

Safe harbor

If you act in good faith and follow this policy, we consider your research authorised. We will not pursue or support legal action against you, and we will work with you to understand and fix the issue quickly. If a third party brings legal action about activity that followed this policy, we will make it known that your actions were authorised. This safe harbor does not cover activity that breaks the rules above or the law.

Our response times

• Acknowledgement within 3 business days.
• Initial assessment and severity rating within 7 business days.
• Fix targets: critical within 7 days, high within 30 days, medium and low within 90 days.
• We keep you updated on progress and tell you when the fix is live.

Recognition

We do not run a paid bug bounty at the moment. With your permission we credit valid reports on this page, and exceptional findings may receive free access to CyberA4U courses.