Responsible Disclosure.

ProteQon believes security is a shared responsibility. We welcome reports from security researchers who identify potential vulnerabilities in our website or services, and we are committed to working with the community to verify, reproduce, and remediate legitimate issues promptly.

This policy applies to assets owned and operated by ProteQon, including:

• Our public website and any subdomains we operate.
• Services we directly host and control.

Client environments we test under contract are explicitly out of scope for this policy and are governed by the terms of the relevant engagement agreement.

Email a detailed report to contact@proteqon.com with the subject line "Security Disclosure". Please include a clear description of the issue, the steps to reproduce it, the potential impact, and any supporting evidence such as logs or proof-of-concept code. Where possible, encrypt sensitive details before sending.

To keep everyone protected, we ask that you:

• Make a good-faith effort to avoid privacy violations, data destruction, and service disruption.
• Only interact with accounts you own or have explicit permission to test.
• Do not access, modify, or exfiltrate data that does not belong to you.
• Give us a reasonable time to investigate and remediate before any public disclosure.

We will not pursue legal action against researchers who act in good faith and in accordance with this policy. Activity conducted consistently with these guidelines is considered authorized, and we will work with you to understand and resolve any issue quickly.

We aim to acknowledge valid reports within three business days, keep you informed as we investigate, and notify you when the issue is resolved. While we do not currently operate a paid bug bounty program, we are happy to publicly credit researchers who responsibly disclose qualifying issues.

For any questions about this policy or to submit a report, reach us at contact@proteqon.com.