01Scope
In scope: this R-Series website, as served to the public, and the sample receipts and in-browser tools published on it.
Out of scope: infrastructure and services run by others, including our host's platform and its other customers — report those to their owners; denial-of-service or volume testing; social engineering, phishing or physical attacks; reports from automated scanners with no demonstrated impact.
02How to report
Email security@dcslabs.ai with the subject "Security report". Include what you found, where, the steps to reproduce it and how to contact you. A minimal, reproducible report is enough; you do not need to prove impact by going further. If you think the issue is being exploited now, write "URGENT" in the subject.
03Please
- Test only what you need to show the issue, and stop as soon as you can show it.
- Do not access, change, keep or delete data that is not yours. If you come across someone else's information, stop, keep only minimal redacted evidence and tell us.
- Do not degrade the service for anyone else.
- Give us a reasonable time to fix the issue before you publish.
04What we do
- We aim to acknowledge ordinary reports within 5 working days, and we triage suspected active exploitation or exposed personal data straight away.
- We keep you informed while we fix it, and tell you when it is fixed.
- We normally coordinate publication within 90 days and discuss any justified change with you; we will not ask for indefinite secrecy.
- We credit you publicly if you want, once the issue is fixed. We do not run a paid bug bounty today.
- Any duty we have to report an incident to authorities or affected people runs separately from this policy.
05Safe harbour
We authorise good-faith, minimal-impact research on the assets in scope, under this policy. We will not bring legal claims against you for research within this authorisation. This authorisation covers only what we control; it does not extend to our providers' infrastructure, and it cannot bind other parties or authorities.