Security Policy

Email security@solanavibestation.com with a description of the issue, the affected URL or endpoint, the steps to reproduce, and the impact you observed. Proof-of-concept code or screenshots are welcome.

In scope for security research:

• Production RPC endpoints under *.solanavibestation.com
• The public web application and the customer portal
• The VPS control plane and console-proxy surface

Out of scope:

• Denial-of-service or volumetric testing of any kind
• Social-engineering or phishing of staff or customers
• Third-party services we integrate with (our payment processors and Discord) — please report issues in those platforms to their own security programs
• Recently-disclosed CVEs without a working proof-of-concept against our deployment
• Physical attacks on our facilities or staff

Good-faith security research conducted within the scope above is authorized. We will not pursue legal action against researchers who follow this policy, give us reasonable time to remediate before public disclosure, and avoid privacy violations, data destruction, or service degradation.

We aim to acknowledge reports within 5 business days and to provide an initial triage update within 15 business days. These are targets, not contractual commitments — remediation timelines depend on severity and complexity.

Default disclosure window is 90 days from the date we acknowledge the report. We may request an extension for complex fixes; we will not invoke an extension to delay disclosure of a remediated issue.

We do not operate a paid bug bounty at this time. We will, however, acknowledge researchers who report valid issues in good faith on a case-by-case basis — reach out if you would like a write-up on our blog.

Report network abuse, spam, or takedown requests related to traffic originating from our infrastructure to security@solanavibestation.com. Include the source IP or hostname, timestamps with timezone, and any log evidence you can share.