Report a security vulnerability

Send a vulnerability report and find the common research scope, exclusions, and bounty terms.

Email bugs@solarius.me with the product, target or version, UTC observation time, affected account boundary, prerequisites, minimal reproduction, observed result, and supported impact. Distinguish reproduced results from source analysis or tool suggestions. Redact secrets and unrelated personal information; request a secure channel for necessary sensitive proof.

Before active testing, read the security and bug bounty policy. Its authorization rules, exclusions, and award conditions govern separate parts of the process. Do not test DoS/DDoS, enumerate customer data, or assume a report creates payment eligibility.

Keep the report reference for follow-up. Solarius aims to acknowledge a sufficiently identified report within 5 business days under that policy. Active compromise also requires incident reporting and the customer's security contact; do not wait for research triage.