1. Purpose

This policy provides a safe and clear process for reporting security vulnerabilities to PakPedia. It encourages responsible, coordinated disclosure and protects researchers, contributors, and users who follow the guidelines. Our goal is to ensure system integrity and protect civic information from unauthorized access or misuse.

2. Who This Policy Is For

This policy applies to:

• Security researchers
• Ethical hackers
• Technical experts
• Contributors and community members
• Anyone who identifies a security vulnerability in PakPedia’s systems

PakPedia welcomes responsible, good-faith reports from all individuals.

3. What to Report

PakPedia encourages reporting of any security issues, including:

• Unauthorized access vulnerabilities
• Injection vulnerabilities (SQL, script, or similar)
• Authentication or session flaws
• Misconfigured access controls
• API or data exposure risks
• Broken permission models
• Potential data tampering risks
• Unauthorized file upload issues
• Platform stability or availability vulnerabilities

Do not test using destructive methods or attacks that disrupt service.

4. Reporting Guidelines

To ensure safe and responsible reporting:

4.1 Act in Good Faith

Your goal must be to protect the platform—not to exploit or damage it.

4.2 Do Not Exploit the Vulnerability

• Do not access, modify, or delete data.
• Do not attempt to escalate your privileges.
• Do not test at scale or perform denial-of-service actions.

4.3 Provide Clear Details

A valid report should include:

1. Description of the issue
2. Steps to reproduce
3. Potential impact
4. Any logs, screenshots, or technical notes
5. Your contact for follow-up (optional)

4.4 Use the Official Reporting Channel

Send reports directly to:

[email protected]

PakPedia does not accept vulnerability reports through social media or informal messaging.

5. What Not To Do

Reporters must not:

• Run automated scanners that overload systems
• Modify civic or legal data through unauthorized access
• Attempt to access contributor or moderator accounts
• Publicly disclose vulnerabilities before PakPedia resolves them
• Use vulnerabilities for personal or political gain
• Upload malware of any kind
• Attempt ransom, extortion, or threat-based disclosures

Violations may result in investigation or legal consequences.

6. How PakPedia Handles Reports

6.1 Acknowledgment

PakPedia will acknowledge receipt of valid reports within a reasonable timeframe.

6.2 Assessment

Security experts will review:

• Severity
• Impact
• Exploitability
• Required remediation steps

6.3 Resolution

PakPedia will work to fix legitimate issues as quickly as possible, prioritizing high-risk vulnerabilities.

6.4 Communication

When the issue is resolved:

• The reporter may be notified (if contact was provided).
• A transparency notice may be issued for significant security matters.

PakPedia does not publish reporter names unless explicitly permitted.

7. No Retaliation Promise

PakPedia will not take legal or administrative action against individuals who:

• Report security vulnerabilities ethically
• Follow this Responsible Disclosure Policy
• Avoid exploitation or harmful activity

Good-faith research is protected and encouraged.

8. Safe Harbor

Researchers acting in accordance with this policy are:

• Authorized to test within these guidelines
• Exempt from DMCA/anti-hacking claims related to good-faith reporting
• Protected from contributor account bans (unless other policies are violated)

Safe Harbor applies only when actions remain non-destructive and within the scope of ethical testing.

9. Patch & Update Transparency

For significant issues:

• PakPedia may publish a security update or platform notice
• The change will be logged in version history
• The evidence-based decision trail will be preserved

PakPedia prioritizes transparency without exposing sensitive technical detail.

10. Policy Violations

The following may lead to enforcement actions:

• Public disclosure before coordinated release
• Exploiting a vulnerability
• Attempting to access user or contributor data
• Causing service interruption
• Using vulnerabilities for influence or manipulation
• Attempting extortion or demanding compensation

PakPedia reserves the right to escalate serious violations to authorities.