Responsible Disclosure

This page describes how to report security vulnerabilities affecting HPanel. Please report issues privately to allow a coordinated fix and safe disclosure.

Vulnerability Reporting

Email: security@hpanel.net

Include:

• Description
• Affected versions
• Reproduction steps
• Logs (if safe)
• Impact assessment

Disclosure Policy

• No public disclosure before a fix or mitigation is available.
• We may coordinate a disclosure timeline with the reporter based on severity and operational risk.

Response Timeline

• Acknowledgement: 24–72 hours
• Initial triage: within 7 days
• Fix target: 14–30 days (severity based)

Safe Harbor

Good-faith research is permitted. Do not exploit issues beyond what is necessary to demonstrate impact, and do not access or exfiltrate user data.