Reporting a security issue on megaparts.ch
This policy explains how to report a technical security or configuration issue affecting megaparts.ch, its DNS and mail records, or its static files. Scope is restricted to domain assets operated by PartsOutlet s.r.o.; no monetary bug bounty program is offered.
Security contact & OpenPGP key
OpenPGP key for encrypted security reports
1. In-scope assets
Scope covers https://megaparts.ch, https://mta-sts.megaparts.ch, static website files, and DNS and mail authentication records under megaparts.ch.
Third-party infrastructure operated by Cloudflare, Inc. or Google Workspace falls under those providers' respective security programs unless the defect lies in our domain configuration. Do not submit third-party confidential data or source code.
2. Authorized good-faith disclosure
We will not take legal action against good-faith security research carried out within the boundaries below solely to identify and report a vulnerability to PartsOutlet s.r.o.
No financial rewards or bounties are offered; attribution may be published by separate mutual written agreement.
3. Testing boundaries
Halt testing as soon as the issue is reproducible, and do not access, modify, or retain data belonging to third parties.
- No denial-of-service traffic, credential brute-forcing, or automated bulk scanning of megaparts.ch, and no mass email to contact@megaparts.ch.
- No phishing, fraudulent invoices, or social engineering targeting PartsOutlet s.r.o. or its counterparties.
- Unverified scanner output without a concrete exploitable defect is out of scope.
4. Submission format
Send reports to contact@megaparts.ch (optionally encrypted with OpenPGP key 3610 DDDB 384E E9AD EF19 2B86 543B 0934 385E E516) stating the affected URL or record, reproduction steps, and technical impact.
Please coordinate any public disclosure with us in advance.
Acknowledgments
Reporters of verified in-scope issues may be listed here upon mutual written consent.