CyberPanel Vulnerability Disclosure Policy

We welcome reports from security researchers who help keep CyberPanel and its users safe. This page describes how to report vulnerabilities in our products and infrastructure, and what you can expect from us in return.

Scope

• cyberpanel.net, platform.cyberpanel.net, platform.cyberpersons.com
• CyberPanel control panel (open source) — github.com/usmannasir/cyberpanel
• CyberVPN Android app, CyberMail email infrastructure, CyberDNS nameservers
• CyberPanel-hosted customer infrastructure (only with explicit prior authorization)

Out of scope

• Denial of service, volumetric attacks, or resource exhaustion
• Social engineering of CyberPanel staff or customers
• Physical attacks on our data center or office locations
• Reports from automated scanners without validated impact (version fingerprinting, missing HTTP headers without demonstrated exploit)
• Customer-owned servers or applications running on CyberPanel without the customer's written consent

How to report

Send vulnerability reports to [email protected]. Please include:

• Clear description of the issue and affected endpoint/component
• Steps to reproduce (proof of concept, screenshots, or video if possible)
• Suspected impact and any mitigating factors
• Your preferred contact method for follow-up

What to expect

• Acknowledgement within 3 business days
• Initial assessment and severity triage within 7 business days
• Fix timeline: critical issues patched within 7 days, high within 30 days, lower severity as scheduling permits
• Coordinated disclosure: we ask researchers to hold public disclosure until a fix is deployed. We will credit you publicly with your consent.

Safe harbor

We will not pursue legal action against researchers who:

• Stay within the scope above
• Avoid privacy violations, destruction of data, and service degradation
• Give us reasonable time to fix an issue before public disclosure
• Do not exploit findings beyond what is necessary to demonstrate the vulnerability

Recognition

Researchers who report valid findings will be credited on this page (with consent). We do not currently run a paid bug bounty program but regularly offer service credits or recognition for meaningful contributions.

Hall of Fame

• Simon Gajdosik — CEO & Founder, Webnestify s.r.o. — CyberVPN v1.2 / v1.3 security audit (April 2026): rate limiting gap on login endpoint, CORS wildcard on mobile API, Android backup flag, deprecated security-crypto dependency, and responsible disclosure throughout two audit rounds.
• Corrie Sloot — CEO & Founder, CyberFortress Security Inc. — Cloud misconfiguration (August 2026): identified and responsibly disclosed a dangling DNS record that enabled subdomain takeover on cyberpanel.net, with cryptographic proof of the issuance path.