Responsible disclosure
If you find a security vulnerability in corrplus.net or a Corrplus product, please report it to security@corrplus.net. This policy sets out what is in scope, the rules we ask you to follow while testing, and our commitment not to pursue legal action against researchers acting in good faith. There is no bounty, but we take every report seriously and tell you the outcome.
How do you report a vulnerability?
Send your report to security@corrplus.net. A good report includes:
- The affected domain, URL or component.
- The type of vulnerability and its likely impact.
- Step-by-step instructions to reproduce it, with screenshots or a proof of concept if you have them.
- An email address where we can reach you.
You can write in English or Turkish. Please do not share the issue with others until we have fixed it.
What is in scope?
| In scope | Out of scope |
|---|---|
| corrplus.net | Third-party services themselves, such as Vercel, Cloudflare, Google, Resend and WhatsApp |
| freelancerflowai.com and the FreelancerFlow iOS app | Denial of service (DoS/DDoS) and load testing |
| promptorai.com and the Promptor WordPress plugin | Social engineering, phishing and physical access attempts |
| okey101cetele.com | Missing HTTP headers or version banners without a demonstrated, realistic impact |
| villayonet.com | Our clients’ own systems and websites |
If you find an issue in a third-party service, report it to that provider directly. If you notice a vulnerability in a system we built for a client, you can write to us and we will pass it to the right team with the client’s agreement.
What rules apply while testing?
- Test only with accounts and data that belong to you. If you reach someone else’s data, stop, do not keep it, and tell us.
- Do not delete, modify or exfiltrate data.
- Do not disrupt the services or affect other users.
- Run automated scanners at a low rate that does not strain the site.
- Do not exploit the issue beyond what is needed to show that it exists.
What is our safe harbour?
We consider security research carried out in good faith and in line with this policy to be authorised. As long as you follow these rules, we will not take legal action against you or report you to law enforcement. If a third party takes action against you for research that followed this policy, we will make clear that your work was in line with it. This commitment does not bind third parties. If you are unsure whether a test is in scope, ask security@corrplus.net first.
What happens after you report?
We confirm that we received your report, validate the issue and plan a fix based on its severity. We keep you informed along the way and tell you when the fix is live. If you want to publish your findings, please agree the timing with us.
Is there a bounty?
No. Corrplus does not run a paid bug bounty programme. Submitting a report does not create a right to payment or any other reward.