Security Policy

Email hello@eyeban.ir with a clear description, steps to reproduce, affected URLs or versions, and impact. Do not include customer source code unless we ask for a minimal sample. Encrypt sensitive details if you can, and give us a contact method for follow-up.

In scope: eyeban.ir web application, authentication and account flows we operate, and officially published Eyeban desktop builds.

Out of scope for this policy: social engineering of staff, physical attacks, denial-of-service, and reports against third-party services we do not control.

We will acknowledge valid reports when practical, investigate, and remediate based on severity. We do not currently operate a public bug bounty with fixed payouts. We may recognize helpful reporters with credit if you want it and disclosure will not increase risk.

If you research in good faith, avoid privacy violations and service disruption, and promptly report findings to us without exploiting them beyond what is needed to demonstrate the issue, we will not pursue legal action for that research. This safe harbor does not authorize access to other users’ data or systems beyond Eyeban assets in scope.

Security: hello@eyeban.ir