Vulnerability disclosure
Security policy
Found something in this site or in one of our tools? We want to hear about it. Research done in good faith within the rules below is welcome and authorised, and we will not pursue action against you for it.
V/01Scope
- arklink.co and every subdomain.
- Open-source projects under github.com/kosiorkosa47, including honeymcp. For those, a private security advisory on GitHub is the preferred channel.
- Third-party services we use (hosting, e-mail, analytics) are out of scope. Report those to their vendors.
V/02How to report
- E-mail hello@arklink.co with what you found, where, the steps to reproduce it and the impact you believe it has.
- Write in English or Polish.
- Please give us a reasonable chance to fix it before you publish anything.
V/03Rules
- No denial of service, volumetric testing or anything that degrades the site for others.
- No social engineering, phishing or physical attacks.
- Access only what you need to demonstrate the issue. If you reach someone else's data, stop, do not keep it, and tell us.
- Do not run scanners at volume. The rate limits will block you before you learn anything.
V/04What we commit to
- We acknowledge your report within five business days.
- We keep you informed while we fix it and tell you when it is done.
- We credit you below if you want to be credited, under the name you choose.
- We do not pay bounties. We are a small lab and would rather say so than imply otherwise.
This site is instrumented
Some paths on this site are deliberate deception surfaces for automated agents, and abuse is logged as described in the privacy policy. Good-faith research within these rules is never treated as abuse. Privacy policy
V/05Thanks
No reports yet. Be the first.