Report privately
Email [email protected]. Include the affected product or URL, a description, impact, and the minimum steps needed to reproduce the issue. Please use English or Persian.
Do not include unrelated personal information, live credentials, or a large data extract. If sensitive evidence is necessary, first ask us to arrange an appropriate transfer method.
Our machine-readable reporting contact is at /.well-known/security.txt.
Scope
Reports may concern bayatlabs.ir, docs.bayatlabs.ir, or Bayat-developed products such as Toranj and Twins. Third-party stores, ad networks, hosting systems, and other providers have their own reporting processes. If a finding belongs to a provider, we may direct you there.
Research guidance
Avoid service disruption, destructive tests, denial of service, social engineering, physical access, and access to other people’s information. Stop testing if you encounter personal information; describe the exposure without collecting additional records.
Limit any verification to what is necessary to show the issue. Do not change or delete data or attempt to maintain access.
Handling and disclosure
We assess reports based on impact and evidence, may ask for clarification, and aim to coordinate remediation and disclosure. Acknowledgement and resolution times depend on the report; this page does not promise a fixed service-level agreement.
Please give us a reasonable opportunity to assess and address a credible report before public disclosure. We will try to communicate a suitable disclosure timeline.
This page provides a reporting channel. It does not establish a paid bug bounty, a blanket authorization to test systems, or legal immunity. Applicable law and third-party rights continue to apply.
Other enquiries
Use [email protected] for ordinary technical problems and [email protected] for personal-data requests. See contact information for other routes.