Home › Security › Responsible disclosure

Security · Policy

Responsible disclosure policy: report a vulnerability to QULDEX

In shortThe QULDEX responsible disclosure policy explains how to report a security vulnerability and what happens next. Email security@egvservices.com with steps to reproduce. We acknowledge within 3 working days, do not take legal action against good-faith research that follows this policy, and credit researchers who wish to be named.
How to reportRead the safe harbour
Written by QULDEX EditorialReviewed by Abhishek Yadav, Lead AuditorUpdated 7 Oct 2026

How do I report a vulnerability to QULDEX?

Email our security team. Please do not post details in public channels, support chats or social media.

security@egvservices.comOpen email

What to include

  • A description of the issue and why it matters
  • The exact address, screen or request affected
  • Step-by-step instructions to reproduce it
  • Proof, such as a screenshot or the request and response
  • Your name or handle, if you would like to be credited

Sensitive details

  • Do not send passwords, keys or personal data in your first email
  • If your report needs them, say so and we will arrange a secure way to share them
  • Write in English if you can
  • You may report anonymously; we can only reply and credit you if you leave a contact

What is in scope?

In scope

  • quldex.com and blog.quldex.com, the public websites
  • dashboard.quldex.com, the QULDEX web application, and its API
  • The QULDEX Android app

Out of scope

  • Services run by other companies (hosting, payments, scheduling, analytics): report those to the provider
  • Denial-of-service or load testing
  • Social engineering of staff, customers or partners, including phishing
  • Physical access to offices or devices
  • Spam, or findings that need a victim's unlocked device
  • Scanner output with no working proof
  • Missing headers or settings with no demonstrated impact

Not sure whether something is in scope? Ask us at the address above before you test.

What are the rules for testing?

Please do

  • Test only against accounts and data you own or have permission to use
  • Stop and report as soon as you can show the issue exists
  • Give us reasonable time to fix it before telling anyone else
  • Keep details confidential until we agree on disclosure

Please do not

  • Access, change, copy or delete other people's data
  • Degrade or interrupt the service
  • Keep data you came across; delete it and tell us what it was
  • Use a finding to move further into our systems
  • Demand payment in return for details

Will I be protected if I report in good faith?

Safe harbour

If you make a good-faith effort to follow this policy, we consider your research authorised. We will not start or support legal action against you for it, and we will work with you to understand and fix the issue quickly.

If someone else takes legal action against you for research that followed this policy, we will make it known that your actions were carried out under it.

This applies to QULDEX systems only. We cannot authorise testing of systems that belong to other companies.

What happens after I report?

The same four steps for every report.

  1. We acknowledgeA person confirms we have your report.Within 3 working days
  2. We assessWe reproduce the issue, rate its severity and tell you what we found.Within 10 working days
  3. We fixWe fix it in order of risk and keep you updated.Updates at least every 14 days
  4. We closeWe tell you when it is fixed and, if you wish, credit you.On release

QULDEX does not run a paid bug bounty programme at present. If you would like to be credited, tell us the name or handle to use.

When can I make my findings public?

We follow coordinated disclosure. Please keep details private until the issue is fixed, or for 90 days from your report, whichever comes first. If a fix needs longer, we will tell you why and agree a date with you.

security.txt

This policy is also published for researchers and scanners at quldex.com/.well-known/security.txt (RFC 9116).

Contact: mailto:security@egvservices.com
Policy: https://quldex.com/responsible-disclosure
Canonical: https://quldex.com/.well-known/security.txt
Preferred-Languages: en
Expires: 2027-10-01T00:00:00.000Z

Responsible disclosure: common questions

How do I report a vulnerability in QULDEX?

Email security@egvservices.com with a description, the affected address, steps to reproduce and proof. Please do not report vulnerabilities through public channels.

Will I get into legal trouble for testing?

Not if you act in good faith and follow this policy. We treat such research as authorised and will not pursue legal action against you for it.

Does QULDEX pay bug bounties?

QULDEX does not run a paid bug bounty programme at present. We credit researchers who ask to be named.

When can I publish what I found?

After the issue is fixed, or 90 days after your report, whichever comes first, unless we agree a different date together.

What if I came across customer data?

Stop testing, do not keep or share it, and tell us what you saw in your report so we can act on it.

Related

SecurityTrust centerService statusPrivacyContact
Schedule
Book a Demo