Found something? Tell us first.
Albakeys runs its own site, admin console and hosting as a security product. If you believe you have found a vulnerability in anything we operate, we want to hear from you — and we treat good-faith research as a gift, not a threat.
security@albakeys.com · /.well-known/security.txt
Scope
In scope: albakeys.com and www.albakeys.com, the admin console under /admin, the public API under /api and the identity endpoints under /auth. Out of scope: any other hostname on our shared hosting (they belong to other organisations), third-party services we embed (Cloudflare Turnstile, Google Analytics, Resend), denial of service, social engineering and physical attacks.
How to report
Email security@albakeys.com in English, Arabic or Turkish. Include the affected URL or component, steps to reproduce, your assessment of the impact and how we can reach you. Prove the issue with the minimum necessary — do not retrieve, modify or store data beyond what the proof requires.
What we commit to
We acknowledge every report within three business days and give you a severity assessment within seven. You hear from us at least every fourteen days until the issue is closed. Target fix windows: critical seven days, high thirty days, medium ninety days. We credit you publicly once a fix is live, if you want that.
Safe harbor
Research that stays in scope, avoids availability impact, touches no third-party data and stops as soon as personal data is encountered is authorised conduct under this policy. We will not pursue legal action against you for it and will say so to anyone who asks.
Rewards
We do not run a paid bounty programme today. Reports are acknowledged, fixed and credited; we will say so clearly if that changes.