Last updated
Security Disclosure Policy
May 20, 2026
This policy explains how to responsibly report vulnerabilities or security issues related to Ges2l.
Ges2l appreciates good-faith reports that help protect the platform, institutions, and users.
How to report a vulnerability
If you found a possible vulnerability in Ges2l, contact us at:
Please include as much information as possible:
- Affected URL or module.
- Clear steps to reproduce the issue.
- Expected impact or possible risk.
- Minimal evidence, such as screenshots or technical logs, without exposing sensitive data.
- Browser, operating system, or technical context when relevant.
Scope
You may report issues related to:
- The public Ges2l landing site.
- Ges2l web applications.
- Authentication, sessions, roles, and permissions.
- Accidental information exposure.
- Insecure configuration visible from the outside.
- Issues that may affect the confidentiality, integrity, or availability of the platform.
Prohibited testing
Do not perform destructive or invasive actions. In particular, avoid:
- Denial-of-service attacks or aggressive load testing.
- Mass extraction of information.
- Accessing, modifying, or deleting third-party data.
- Social engineering, phishing, or unauthorized contact with users or institutions.
- Spam, abusive automation, or persistent exploitation.
- Installing malware, backdoors, or tools that maintain unauthorized access.
If a test shows that a real risk exists, stop testing and report it with the minimum evidence required.
Handling sensitive data
Do not include personal, academic, financial, or institutional data from third parties in the report unless strictly necessary to demonstrate the issue.
If you accidentally access sensitive information, do not download it, do not share it, and do not continue exploring. Report the finding with general context.
Response
We will try to review good-faith security reports and prioritize them based on impact.
Response times may vary depending on the complexity of the report and the current state of the project.
Rewards
Ges2l does not currently offer a public monetary rewards or bug bounty program.
Even so, we appreciate responsible reports that help improve the security of the platform.
Public disclosure
Do not publicly disclose a vulnerability before it has been reviewed and mitigated.
If you want to publish research, coordinate with us first to avoid exposing users, institutions, or active systems.
Contact
For security reports, preferably use: