Hypershell highly values the security of its products and services, and is committed to developing secure and reliable products and ensuring user privacy protection. In the meantime, we’ve realized that security researchers play an important role in protecting Hypershell’s products and consumers, which is why the Vulnerability Disclosure Program (hereinafter referred to as the Program) is developed. The Program provides a secure channel for researchers to report security issues of the Company and offers effective measures to triage and mitigate the security vulnerabilities. We are truly grateful to the researchers who followed the practice of responsible disclosure and did not disclose the vulnerabilities prematurely during the time required for issue resolution. Premature public disclosure of the vulnerabilities will put Hypershell users at higher risks. If you have identified any security vulnerabilities or issues in any domain names that belong to or relate to Hypershell, you are advised to report the vulnerabilities or via security@hypershell.tech.

Please encrypt sensitive vulnerability reports using this PGP key[Key fingerprint: 7165 6786 D1EA 4C53 E497 FB48 04EE 38C4 D907 6B4C; Download PGP public key (.asc)].

Generally, we will acknowledge receipt of your report within 48 hours, provide preliminary validation findings within 10 business days, and share progress updates at least every 30 days until the report is closed.

If the vulnerability is confirmed to be valid and exploitable, we will publish a security advisory on the Vulnerability Disclosure Program page of our official website.

To protect our users, Hypershell will not disclose, discuss or confirm any security issues before a full investigation is completed with available updates.

Before you get into the details of the Program, please take a close look at the policies, terms, and conditions of the Program.

Responsible Disclosure - Policy

When reporting a security vulnerability to Hypershell, we ask that:

• You give us reasonable time to investigate and mitigate an issue you report before making any information contained in the report public or information shared with 3rd. During this process, we may contact you using the contact details you provided if additional information is needed to reproduce or assess the reported vulnerability.
• You do not exploit a security issue you discover for any reason. This includes demonstrating additional risk, such as attempts to compromise sensitive company data or probing for additional issues.
• You do not intentionally violate any other applicable laws or regulations.
• You do not violate any privacy rules, privacy regulations, or cause disruptions to others including, but not limited to unauthorized access to or destruction of data and interruption or degradation of our services.
• You read, agree and align with Hypershell Company Privacy Policy.
• You read, agree and adhere to our Responsible Disclosure Terms & Conditions.

Responsible Disclosure - Terms & Conditions

• If you inadvertently or intentionally access Hypershell and its affiliates’ proprietary customer, employee, or business related information during your testing, the information must not be used, disclosed, stored, or recorded in any way. Access to any such data must be declared as part of your vulnerability report.
• By submitting information about a potential security vulnerability, you are granting Hypershell a worldwide, permanent, royalty-free, non-exclusive license to use your submission for the purpose of addressing security vulnerabilities in Hypershell or its affiliates’ products and services.
• By submitting a security vulnerability report, you affirm that you have not previously disclosed the security vulnerability to anyone other than Hypershell. Absent Hypershell prior written consent, any disclosure outside of this process would be a violation of the terms & conditions of the Program.

Security Advisery

Future advisories will be posted in this section, including affected products and versions, descriptions of fixed vulnerabilities, their impact and severity, and instructions for obtaining and applying the updates.