How to report security issues to G8KEPR. We acknowledge reports within 48 hours and provide an initial assessment within 7 days.
Make a good-faith effort to avoid privacy violations and service disruption
Do not access, modify, or delete customer data
Do not exploit vulnerabilities beyond the minimum necessary to demonstrate impact
Do not publicly disclose without coordinating with us first
Allow 90 days for remediation before public disclosure (default)
Contact security@g8kepr.com before starting research if you have questions about scope
Vulnerability description and CVE/CWE reference if applicable
Detailed steps to reproduce
Impact assessment (what an attacker could accomplish)
Affected component or URL
Suggested remediation if you have one
Your contact information if you want acknowledgment
48 hours
Acknowledgment
7 days
Initial Assessment
90 days
Remediation Target
Coordinated
Public Disclosure
G8KEPR will not pursue legal action against researchers who follow this policy in good faith. We consider good-faith security research to be a valuable contribution to the security community and to our platform.
Where this policy conflicts with any applicable law, we will work with you to understand the intent of your research. We adhere to ISO/IEC 29147 (Vulnerability Disclosure) and ISO/IEC 30111 (Vulnerability Handling Processes) where applicable.
With your consent, we list researchers who have responsibly disclosed valid vulnerabilities on our Researchers page.
We do not currently offer a monetary bug bounty. For exceptional findings we may offer swag or other recognition. A formal bug bounty program is under consideration for 2026 H2.