Report a vulnerability

The security of our users is our priority. If you discover a security vulnerability on Delos, we encourage you to report it responsibly.

How to report

Send an email to security@delos.so with:

• A detailed description of the vulnerability
• Steps to reproduce it
• The potential impact
• Your contact details (optional, for follow-up)

Our commitment

• Acknowledgment within 24 hours
• Initial analysis within 72 hours
• Transparent communication throughout the process
• Recognition in our Hall of Fame (if desired)

Responsible Disclosure Rules

• Do not access other users' data
• Do not disrupt the service
• Do not disclose publicly before the fix
• Allow us a reasonable time to fix (90 days)

Types of vulnerabilities in scope

• Injections (SQL, XSS, etc.)
• Authentication or authorization issues
• Data leaks
• Configuration issues
• Dependency vulnerabilities

Out of scope

• Social engineering / phishing attacks
• Physical attacks
• Denial of service (DoS/DDoS)
• Spam