責任ある脆弱性公開
Neurako の学習者と学習データの安全を守るための、善意のセキュリティ研究を歓迎します。
01. 報告の方法
Email reports to [email protected] with the subject prefix [SECURITY].
If you send proof-of-concept requests to our systems, include the HTTP header X-Neurako-Security-Research: [email protected] so we can distinguish testing from abuse in logs.
Include the affected URL or API endpoint, steps to reproduce, impact, screenshots or request/response snippets when useful, and whether you want public credit.
02. 対象になるもの
- Neurako web app: app.neurako.com
- Neurako marketing site: neurako.com and www.neurako.com
- Neurako iOS and Android applications
- Neurako-owned API endpoints used by the apps
- Access-control, authentication, payment-accounting, storage, and user-data issues
03. 対象外のもの
- Denial-of-service, spam, phishing, or social-engineering tests
- Physical attacks, employee targeting, or attempts to access employee accounts
- Automated scanner output without a reproducible security impact
- Reports for third-party services unless they directly affect Neurako users
- Issues requiring compromised devices, rooted devices, or user-installed malware
04. 調査のルール
Use your own accounts and test data. Do not access, modify, delete, or exfiltrate data that does not belong to you. Stop testing and report immediately if you encounter another user's data.
Keep testing low volume, avoid persistence, and do not publicly disclose a vulnerability before we have had a reasonable opportunity to fix it.
05. 実績の認定について
We do not currently operate a bug bounty program and cannot offer monetary rewards, swag, or other compensation for reports.
For valid, helpful reports, we can offer public credit in a Hall of Fame entry or security blog article if you want to be named.
06. 返信・対応の目安
We aim to acknowledge security reports within 48 hours.
We aim to provide an initial triage decision within 5 business days and will share material remediation updates when a report is valid and actionable.