/

Responsible disclosure

Security Policy

Effective date: 25 September 2026 · Version 1.0

1. Scope

This policy covers the public website at pelekai.tech and resources served directly from that origin. Customer systems, third-party services, social accounts, internal infrastructure, authenticated PeLeK AI services, and agent/tunnel endpoints are out of scope unless PeLeK AI gives separate written authorization. A service being reachable does not make it in scope.

2. Good-faith research rules

Use the minimum testing necessary to confirm a finding. Do not perform denial of service, brute force, phishing, social engineering, physical attacks, persistence, destructive actions, supply-chain attacks, or tests that impair availability. Do not access, modify, download, retain, or disclose another person's data beyond the minimum unavoidable proof. Stop immediately if sensitive data or unsafe impact is encountered.

Research consistent with this policy and applicable law will be treated as good-faith activity for this program. This statement does not authorize activity outside the scope above or on systems owned by others.

3. How to report

Use a current contact listed in security.txt. Include the affected URL or component, a concise description and impact, reproducible steps, supporting request/response details with secrets removed, and a safe way to contact you. Send one vulnerability per report where practical. Do not include unnecessary personal data, credentials, exploit payloads that cause harm, or publicly disclose an unresolved issue.

4. Handling and coordinated disclosure

PeLeK AI will make a reasonable effort to acknowledge, assess, remediate, and keep the reporter informed according to severity and reproducibility. Please allow reasonable time for investigation and correction before disclosure. Reports may be closed when they are non-reproducible, informational only, out of scope, or duplicate. This is not a bug-bounty program and no payment or reward is promised unless agreed in writing before the work.

5. Common exclusions

Examples normally not accepted as vulnerabilities include missing optional headers without demonstrated impact, clickjacking on pages with no sensitive action, self-XSS, user enumeration without material impact, scanner-only output, rate-limit observations that require service degradation to prove, publicly known files or versions without an exploitable condition, and findings that require obsolete unsupported clients. PeLeK AI may update this policy prospectively; the effective date above identifies the current version.