devwalls security
Responsible Disclosure & Safe Harbor
We welcome responsible research from independent security practitioners. Here are our scope rules, SLA commitments, and full legal Safe Harbor protection.
1. Our Security Commitment
At Devwalls Security, security is our primary craft. We recognize the invaluable role that independent security researchers, ethical hackers, and bug bounty hunters play in keeping the internet resilient.
If you discover a vulnerability in our infrastructure or digital assets, we encourage you to disclose it to us responsibly. We commit to working with you collaboratively to validate, remediate, and publicly acknowledge your contribution.
2. Legal Safe Harbor Commitment
We consider research conducted under this policy to be:
- Authorized: Authorized under applicable computer crime legislation (including the Cybercrimes Prohibition Act of Nigeria and international equivalents).
- Exempt from Legal Action: We will not initiate or support legal action against you for accidental, good-faith violations of this policy, provided you adhere to the ground rules below.
- Lawful Research: We consider your research lawful, helpful to the community, and conducted in good faith.
3. Scope & Target Assets
In-Scope Targets
devwalls.com.ngwww.devwalls.com.ng- Official Devwalls APIs and public web endpoints
- Public GitHub repositories maintained by Devwalls Security
Strictly Out-of-Scope
- Client systems, client IP ranges, or client test environments
- Denial of Service (DoS / DDoS) testing or network degradation
- Spam, phishing, vishing, or social engineering targeting employees
- Physical attacks against Devwalls facilities or staff
- Third-party cloud infrastructure (Cloudflare, Vercel, Neon)
4. Ground Rules for Researchers
To remain eligible for Safe Harbor protection:
- Protect Data: If you encounter sensitive data (PII, credentials, proprietary keys), halt testing immediately and report it. Do not download, exfiltrate, modify, or retain customer records.
- Non-Destructive Testing: Always use non-destructive payloads. For example, execute
whoamior proof-of-concept print statements rather than dropping destructive files or modifying production state. - Coordinated Disclosure Window: Allow us a standard 90-day window to remediate the vulnerability before any public discussion, advisory publication, or social media disclosure.
- No Extortion: Do not demand compensation or bug bounty rewards under threat of public disclosure or withholding vulnerability details.
5. How to Submit a Vulnerability Report
Send an encrypted email report to our security engineering team at:
Reporting Endpoint: [email protected]
Subject Format: [VULN REPORT] - Vulnerability Type - Target Asset
PGP Key ID: 0x48DF91A2B5E3C710
PGP Fingerprint: 9A4C 1832 B29F DE17 48DF 91A2 B5E3 C710 4401 A8E2
Please include:
- Detailed step-by-step reproduction instructions and minimal proof-of-concept payload.
- Vulnerability classification (e.g. OWASP category, CWE ID).
- Estimated security impact and affected endpoint URLs.
- Your name or handle for Hall of Fame attribution.
6. Response Service Level Commitments (SLAs)
We hold ourselves to transparent, engineering-grade turnaround times:
7. Recognition & Hall of Fame
We are proud to recognize practitioners who help keep Devwalls safe. If you are the first to report a novel, verified vulnerability in an in-scope asset, we will publicly credit you in our Security Researcher Hall of Fame (or honor your request to remain anonymous).