Responsible Disclosure Policy

1. Contact

Security reports

ofirbe@kultarr.io

PGP public key

https://kultarr.io/.well-known/security-pgp-key.asc

Fingerprint

F0B7 78AC 6E0C A51B ABB4 C92D 0152 FEB9 DF0C 10EECopy

Security reports containing sensitive information may be encrypted using the public key above. A machine-readable copy of this contact information is served at /.well-known/security.txt.

2. In-scope systems

Only the assets expressly listed here are authorized targets:

• kultarr.io
• www.kultarr.io

Any additional hostname is in scope only if Kultarr. has listed it here or confirmed it in writing. This list is the authorization; nothing else is.

Explicitly not authorized: any hostname not listed above, including other subdomains of kultarr.io; staging, development and preview environments, including hosting-provider preview URLs, and localhost; Kultarr.’s internal infrastructure; customer cloud accounts, customer AWS accounts, customer endpoints and customer applications; Amazon Web Services infrastructure and services; the email provider (Resend), payment providers, source-repository providers and identity providers Kultarr. uses or connects to; and any other third-party service. A vulnerability reachable through Kultarr. but residing in a customer’s environment is the customer’s to authorize, not ours.

If ownership is unclear, ask before testing.

3. Good-faith research requirements

To remain within this authorization:

• test only the in-scope systems;
• use the minimum interaction necessary to demonstrate the issue;
• use only Kultarr. accounts you created yourself for testing, and connect only cloud accounts and repositories you own;
• stop immediately if you encounter another person’s data, credentials, access keys, tokens or private cloud information; do not use them, and report what you found and how;
• do not retain, copy, alter, transmit or disclose another person’s data, and delete anything you obtained once your report is resolved;
• keep automated scanning to a low rate that does not degrade the Service for others;
• avoid privacy violations, service interruption and degradation;
• report the issue promptly and provide reasonable time for investigation and remediation;
• comply with applicable law.

4. Prohibited testing

This Policy does not authorize:

• denial-of-service, load, stress or resource-exhaustion testing;
• social engineering, phishing or physical intrusion;
• credential stuffing or brute-force attacks;
• malware, ransomware or destructive actions, including deleting or corrupting data;
• accessing, downloading or modifying data belonging to another user or customer;
• pivoting from Kultarr. into a customer’s AWS or other cloud environment, or using Kultarr. to read or change any cloud account you do not own;
• testing third-party providers, including Amazon Web Services, Resend, repository hosts and payment providers, whose own policies govern their systems;
• establishing persistence, installing backdoors or moving laterally after gaining access;
• causing financial charges to Kultarr., its customers or anyone else (including cloud-provider charges from creating resources or generating large volumes of requests);
• sending spam or disrupting communications;
• extortion, threats or demands for payment;
• public disclosure before the coordinated-disclosure period ends;
• testing that violates law or causes harm.

5. What to include in a report

Please include:

• affected asset and endpoint;
• vulnerability type and impact;
• clear reproduction steps;
• proof of concept using non-sensitive data;
• relevant request and response details with credentials removed;
• date and time of testing;
• suggested remediation, if known;
• your preferred contact details and disclosure timeline.

Do not include live credentials, private keys, customer information or more personal data than necessary.

6. Our response targets

Kultarr. aims to:

• acknowledge a complete report within 5 business days;
• provide an initial assessment within 10 business days;
• send reasonable progress updates for validated issues;
• coordinate disclosure based on severity and remediation complexity.

These are targets, not guaranteed service levels.

7. Coordinated disclosure

Do not publicly disclose an issue until Kultarr. confirms remediation or 90 days have passed after a complete report, whichever occurs first, unless a different timeline is mutually agreed or disclosure is legally required.

If active exploitation or immediate public risk exists, contact us so an accelerated timeline can be coordinated.

8. Safe-harbor statement

When research is conducted in good faith, stays within this Policy, avoids harm and is reported promptly, Ofir Benav, as operator of Kultarr., treats it as authorized for the systems listed in section 2, and does not intend to bring a legal claim or make a complaint against you based on that research. If a third party brings a claim about research that complied with this Policy, we will make known that it was authorized.

This authorization extends only as far as the operator’s own legal ability to grant it. It cannot authorize anything against customers, customer environments, Amazon Web Services or other third parties, and it is not, and cannot be, immunity from a claim by a third party or from action by a law-enforcement or regulatory authority.

If there is doubt whether planned testing is permitted, obtain written confirmation before proceeding.

9. Rewards

This Policy does not create a bug-bounty program and does not guarantee payment. Kultarr. may choose to recognize a researcher, subject to consent and applicable law, but any reward must be agreed in writing.

10. No waiver

Nothing in this Policy authorizes unlawful access or waives the rights of customers, users or third parties.