Starlen Cyber Inc. ("Starlen") takes the security of our website and services seriously. We value the security research community and welcome responsible disclosure of any vulnerabilities you discover.

1. Reporting a Vulnerability

If you believe you've found a security vulnerability in any Starlen-owned system, please report it to us privately before any public disclosure. Email contact@starlencyber.com with as much detail as possible, including:

Steps to reproduce the issue, the affected URL or endpoint, the potential impact, and any supporting evidence (screenshots, request/response logs, proof-of-concept).

2. Our Commitment

We will acknowledge receipt of your report within 5 business days, provide an initial assessment of validity and severity within 10 business days, and keep you reasonably informed of remediation progress. We will not pursue legal action against researchers who act in good faith, report privately, avoid data destruction or privacy violations, and give us reasonable time to remediate before any public disclosure.

3. Scope

In scope: starlencyber.com and its subdomains, and the underlying application and API. Out of scope: third-party services we integrate with (e.g., our payment processor, email delivery provider) — please report those directly to the respective vendor. Denial-of-service testing, social engineering, and physical security testing are not authorized under this policy.

4. Safe Harbor

Testing conducted in good faith, consistent with this policy, is considered authorized. Please avoid accessing, modifying, or exfiltrating data beyond what is necessary to demonstrate a vulnerability, and stop testing and notify us immediately if you access anything unexpected (e.g., another user's data).

5. Contact

Email contact@starlencyber.com. Our machine-readable disclosure contact is also published at /.well-known/security.txt, per RFC 9116.