Site

Vulnerability Disclosure

Security is what we do for a living, and our own site is no exception. If you have found a vulnerability here, we would genuinely like to hear about it and we will take it seriously.

Bu sayfanın Türkçesi: Güvenlik Açığı Bildirimi

Scope

This channel covers sistemkusu.com and its pages. Our former domain sercebilisim.com now redirects every request here, and that redirect is in scope too. The third-party platforms the site runs on (hosting, form service and similar) are out of our scope; issues in those belong with the respective provider, though we would appreciate a heads-up as well.

How do you report an issue?

Write to iletisim@sistemkusu.com. To help us verify quickly, please include:

The page or endpoint where you found the issue.
Steps to reproduce; a screenshot or a request/response sample if you have one.
Your assessment of the potential impact.

Our machine-readable contact file is published at /.well-known/security.txt (RFC 9116).

What do we promise?

We read every report and get back to you as soon as we can.
We fix confirmed issues and keep you informed along the way.
Once an issue is resolved, we are happy to credit you by name; staying anonymous is equally fine.
We treat good-faith research that does not harm data or disrupt the service as a contribution, not a threat.

Out of scope

The following are not considered reports through this channel:

Denial-of-service attempts (DoS/DDoS) and high-volume automated scanning.
Social engineering, phishing and physical-access scenarios.
Raw scanner output and version disclosures without a demonstrated vulnerability.
Best-practice suggestions on their own (such as a missing header); you are still welcome to write, but we will ask for evidence of impact.