Clear boundaries.
Responsible research.

1. Reporting scope

We accept reports concerning soluidc.net, its subdomains, and any resource with a demonstrable, direct security impact on the soluidc.net internal network.

• Explain the affected asset, the ownership context, and the direct security impact in your report.
• Testing permission under this program applies only to Nya Labs-controlled assets. This policy does not authorize testing of customer systems, third-party services, employee devices, or unrelated infrastructure.
• You may report a third-party issue that directly affects us, but obtain the asset owner’s authorization before testing that third party.
• If ownership or permission is unclear, submit a scope question before proceeding. A connection, shared hosting provider, or similar domain name alone does not establish scope.

2. Research conduct

• Use your own accounts and data, and the minimum non-destructive verification necessary to explain the issue.
• Do not access, change, download, retain, or disclose other people’s data. If you encounter sensitive information, stop and report only minimal, redacted evidence.
• Do not disrupt services, degrade availability, run denial-of-service or stress tests, brute-force credentials, conduct social engineering, or attempt physical access.
• Do not establish persistence, deploy malware, pivot through the internal network, or expand access after establishing a finding.
• Do not use extortion, threaten disclosure, or contact customers about a finding.

We support good-faith reporting that follows these rules and will work with you to clarify uncertain scope. This program cannot grant permission on behalf of other asset owners.

3. Excluded findings

The following are not accepted as reportable security findings or bounty-eligible submissions under this program:

• Reflected XSS, self-XSS, or issues requiring a user to paste code into their own developer console.
• Missing or insecure security headers, including CSP, HSTS, X-Frame-Options and related header-only configuration findings.
• Cookie attribute findings, including missing HttpOnly, Secure or SameSite flags.
• Generic scanner output, version disclosure, missing banners or best-practice observations without a concrete security impact.
• Clickjacking on pages without sensitive actions, harmless open redirects, and logout-only CSRF without additional impact.
• TLS preference or certificate-chain observations without a demonstrated security consequence; issues confined to unsupported browsers or obsolete clients.
• Spam, email spoofing observations without application impact, missing rate limits without an abuse scenario, and account enumeration without meaningful impact.
• Social engineering, physical attacks, denial of service, third-party-only issues without direct impact, and reports based solely on public information.
• Duplicate findings, already-known issues, or speculative claims without enough information to validate.

Product defects may still be submitted using the Product bug category. Acceptance for product review does not make an excluded security finding eligible for a bounty.

4. What to include

• A concise title, affected asset, report type, and your assessment of impact.
• A clear description of the observed behavior and the expected behavior.
• Safe reproduction steps, prerequisites, and redacted evidence. Do not submit live secrets or personal data.
• Why the finding is in scope and how it directly affects the service or internal network.
• Your contact details so we can request clarification. Submit one underlying issue per report where possible.

Use the private report form. Reports are stored with a reference number and converted into a confidential PDF for review. Linked evidence images must be public HTTPS PNG or JPEG files; no image uploads are accepted.

5. Triage and rewards

Reports are assessed individually for scope, reproducibility, impact, originality, and compliance with these rules. We may request further information, merge duplicates, or classify a submission as informational or out of scope.

Any reward is discretionary and determined after validation. No minimum, fixed amount, or payment is promised by submitting a report. Ordinary product bugs and excluded findings are not automatically eligible. Do not incur costs on our behalf.

6. Coordinated disclosure

Keep vulnerability details, sensitive evidence and our private communications confidential while we investigate and remediate. Coordinate any public disclosure with us in writing. Share only the minimum information needed for responsible reporting.

For urgent operational issues, use the support contact channels. For vulnerability or security incident details, use the private report form.