EQVPS — Vulnerability Disclosure Policy
Last updated: 2026-09-19

We welcome reports from security researchers and will work with you in good faith.
This document is the policy referenced by https://eqvps.com/.well-known/security.txt

HOW TO REPORT
  Email: info@eqvps.com  (subject: "Security report")
  Or:    https://eqvps.com/en/support
  Please include: what you found, where, the steps to reproduce it, and the impact
  you believe it has. A short proof of concept helps us far more than a scanner dump.
  English, Russian or Ukrainian are all fine.

WHAT WE COMMIT TO
  - We acknowledge your report within 3 business days.
  - We tell you our assessment (valid / duplicate / out of scope) within 7 days.
  - We keep you updated until the issue is fixed, and we tell you when it ships.
  - We credit you by name or handle if you want that, and stay quiet if you don't.
  - We do not run a paid bug bounty. We say so plainly rather than implying a reward.

IN SCOPE
  eqvps.com and its subdomains (api., my., mcp., b2b., console.), our public REST API
  (/api/v1/eqvps/*), our MCP endpoint, and the customer cabinet.

OUT OF SCOPE
  - Anything running INSIDE a customer's own virtual server. Customers control those
    systems; report abuse of a customer machine to info@eqvps.com instead — that is an
    abuse report, not a vulnerability in our platform.
  - Denial of service, volumetric or stress testing, and resource-exhaustion attempts.
  - Social engineering of our staff or customers, physical attacks, and spam.
  - Findings that only restate scanner output (missing headers, cookie flags, TLS
    configuration preferences) with no demonstrated impact.
  - Third-party services we merely use, unless the flaw is in how we integrated them.

RULES WE ASK YOU TO FOLLOW
  - Use only accounts and servers you own, or test data you created. Do not access,
    modify or retain other people's data. If you stumble onto someone else's data,
    stop, do not save it, and tell us what you saw.
  - Do not degrade service for our customers, and do not run destructive tests.
  - Give us a reasonable window to fix the issue before publishing. We will not ask
    you to stay silent indefinitely.

SAFE HARBOUR
  If you follow this policy in good faith, we will not pursue or support legal action
  against you for your research, and we will treat your access as authorised for the
  purpose of the report. If a third party takes action against you for research done
  under this policy, we will say publicly that your work was authorised by us.