Athan Sec Vulnerability Disclosure Program

Scope

In scope

Out of scope

• Third-party services we use — Cloudflare, Porkbun, GitHub, Gmail, WhatsApp, HackerOne, Intigriti and others. Report issues in those services to their own programs.
• Any other host on workers.dev or any domain not listed above.
• Any other client website or system not explicitly listed in scope. Testing those is never authorized by this policy.
• Physical security, social engineering, phishing of people, or attacks against personal accounts.

Findings that usually do not qualify

athansec.fyi is a static site with no logins, forms or databases; duplashoes.com is a product catalog with a newsletter sign-up form. These are generally not accepted unless you demonstrate concrete impact:

• Missing or “best-practice” headers, cookie flags, or TLS cipher preferences without a working exploit.
• Clickjacking on pages with no state-changing actions; self-XSS; open redirects without an impact chain.
• SPF/DKIM/DMARC observations that are only policy recommendations, without a demonstrated spoof that bypasses them.
• Version disclosure, banner grabbing, or unverified output from automated scanners.
• Denial of service, rate limiting, or resource exhaustion findings.
• Issues in outdated browsers or that require a compromised device.

Rules of engagement

• Only test assets listed as in scope.
• No denial of service, load testing, or traffic above a few requests per second. Throttle automated tools.
• Do not submit spam or bulk entries through forms (such as the duplashoes.com newsletter). Use only your own email addresses when testing them.
• Do not access, modify, or delete data beyond the minimum needed to show impact. If you encounter sensitive data, stop and report it.
• No social engineering, phishing, spam, or physical attempts.
• Do not disclose a vulnerability publicly before it is resolved or before the coordination window below ends.
• Comply with all applicable laws.

How to report

Email the report to the address below. A good report includes:

• The affected asset and URL.
• Vulnerability type and a description of the impact.
• Step-by-step reproduction, with a proof of concept, request/response or screenshots.
• Whether you would like to be credited, and under what name.

Email

security@athansec.fyi

RFC 9116

/.well-known/security.txt

What you can expect from us

• Acknowledgement of your report within 5 business days.
• An initial assessment within 10 business days, and updates while we work on a fix.
• Credit in the Hall of Fame for valid, previously unknown findings, if you want it.
• No legal action for research that follows this policy (see Safe harbor).

Coordinated disclosure

We ask for up to 90 days from the first report to fix a valid issue before public disclosure. We will try to resolve it sooner and may agree on a different date with you. Once fixed, you may publish your findings; we are happy to review a write-up first.

Rewards

This is a Vulnerability Disclosure Program. Athan Sec does not offer monetary rewards, bounties, or swag. Valid findings are recognized publicly in the Hall of Fame, with your consent.

Safe harbor

Security research carried out in good faith and in accordance with this policy is considered authorized by Athan Sec. We will not pursue civil or criminal action, or file a complaint with law enforcement, against you for that research. If a third party takes legal action against you for activities that complied with this policy, we will make it known that your actions were authorized.

This authorization only covers the in-scope assets listed above. Athan Sec cannot authorize testing of systems owned by third parties.

Hall of Fame

// No entries yet. The program launched on 13 November 2026.

Changelog

• v1.1Added duplashoes.com and www.duplashoes.com to scope.13 November 2026
• v1.0Program launched.13 November 2026

Reports are accepted in English or Spanish. This English version prevails in case of discrepancy.