Security Policy
Paralov takes the security of our users, customers, and systems seriously. We welcome responsible disclosure of security vulnerabilities.
Reporting a vulnerability
Paralov publishes official vulnerability disclosure contact information in oursecurity.txt file.
Please consult /.well-known/security.txt for the most up-to-date contact details, supported encryption methods, and disclosure metadata before submitting a report.
Primary disclosure channel
- Email: security@paralov.com
- PGP key: https://paralov.com/.well-known/pgp-key.asc
When reporting sensitive information, we strongly encourage encrypted communication as indicated in security.txt.
Scope
This policy applies to Paralov-operated assets, including but not limited to:
paralov.comstuds.ggapp.studs.gg- All subdomains and services operated by Paralov unless explicitly stated otherwise
Safe harbor
We consider security research conducted in good faith and in accordance with this policy andsecurity.txt to be authorized.
- Act in good faith
- Avoid privacy violations, data destruction, and service disruption
- Do not access or modify data belonging to other users
- Limit testing to what is necessary to demonstrate impact
What you can expect from us
- Acknowledgment of your report within a reasonable timeframe
- Good-faith communication during investigation and remediation
- Optional public credit in our Hall of Fame
- No legal action for research conducted in accordance with this policy
Out of scope
- Social engineering attacks
- Physical attacks
- Denial-of-Service (DoS / DDoS)
- Third-party services not operated by Paralov
- Reports without a clear security impact
- Denial-of-Wallet beyond what is strictly necessary to display a vulnerability
Legal
This policy does not grant permission to violate laws, access data not belonging to you, or disrupt services. Testing must comply with applicable laws and this policy.
Last updated: