Reporting a vulnerability
Email hello@iblocktechs.com with the subject line "Security report". English or Turkish is fine.
We aim to acknowledge reports within three business days and to keep you informed until the issue is resolved. Please give us a reasonable time to fix an issue before you disclose it publicly.
Please include:
- the affected URL, API endpoint or component;
- the steps to reproduce and the impact you observed;
- any proof-of-concept output, with personal data removed.
Scope
- iblocktechs.com, including the Verify and Trace workspaces, public verification and tracking pages, and the /api/v1 endpoints.
- The Verify/Trace registry contracts on the networks we publish.
Out of scope
- Third-party services we use (report those to the vendor).
- Denial-of-service, and volumetric or automated scanning that degrades the service.
- Social engineering and physical attacks.
Testing guidelines
- Use only accounts and data you own. Do not access, modify or delete other people’s data. Stop and report as soon as you see data that is not yours.
- Do not degrade availability, and respect rate limits.
- Do not attempt to move funds or broadcast transactions with keys that are not yours.