Found a security issue? Help us fix it responsibly.
ShabuShabu Security values responsible vulnerability research. If you believe you have identified a security issue affecting a ShabuShabu-operated system, report it privately so the finding can be reviewed, validated and addressed without unnecessarily increasing risk.
Security research is most useful when it creates a path to remediation.
Vulnerability disclosure works best when researchers and system owners can exchange technical information without creating additional exposure around an unresolved issue.
ShabuShabu therefore encourages clear, private reporting of suspected security weaknesses together with enough context to understand and reproduce the reported behavior.
Report privately
Avoid unnecessary public disclosure while a potential vulnerability remains unresolved.
Minimize impact
Use the minimum interaction necessary to identify and explain the suspected weakness.
Preserve evidence
Provide technical information that helps reproduce the issue without collecting unnecessary data.
Give us enough information to understand the security boundary that failed.
A useful vulnerability report does not need to be long, but it should explain where the issue occurs, how it can be reproduced and what security impact you believe it creates.
Please use our contact channel and clearly identify the message as a security or vulnerability report.
Use the minimum level of access necessary to demonstrate the issue.
If you encounter a possible vulnerability, focus on confirming the existence of the security issue without unnecessarily expanding access, collecting unrelated information or affecting users.
Limit testing
Stop once you have enough evidence to explain the security issue and allow technical reproduction.
Protect data
Do not intentionally access, download, alter or retain information belonging to other users beyond what is necessary to identify the issue.
Report promptly
Share meaningful findings privately so the affected security control can be investigated and remediated.
Responsible disclosure depends on how the vulnerability is handled.
Please do
Please do not
Reporting a vulnerability is different from receiving a penetration-testing authorization.
This page provides a channel for responsible reporting. It should not be interpreted as blanket authorization to actively test arbitrary systems, infrastructure, third-party services or accounts.
ShabuShabu-operated systems
Reports should relate to systems or services you reasonably believe are operated by ShabuShabu.
Third-party platforms
Separate providers and unrelated infrastructure should be reported through their own security channels.
Client environments
ShabuShabu client systems are not automatically authorized for independent testing through this policy.
Uncertain ownership
If you are unsure whether a system belongs to us, contact ShabuShabu before performing additional testing.
From vulnerability report to remediation.
Reports are assessed based on technical reproducibility, affected security boundaries and realistic impact.
Receive
The report is reviewed to understand the affected system and the behavior being described.
Triage
We determine whether the report contains enough information for meaningful technical investigation.
Validate
The suspected issue is reproduced where possible and evaluated for practical security impact.
Remediate
If the issue is confirmed, the affected control can be corrected and further validation performed.
Resolve the vulnerability before increasing exposure around it.
When a valid security issue is reported, we encourage continued private coordination while the technical impact is understood and remediation is being prepared.
If future public disclosure is appropriate, timing and technical detail should be considered in a way that does not unnecessarily place users or systems at risk.
Responsible disclosure is a reporting process, not an open-ended authorization.
Nothing on this page grants unrestricted permission to access systems, user information or infrastructure that you are not otherwise authorized to access.
If you need formal authorization to perform a security assessment, that activity should be covered by a defined testing engagement and agreed rules of engagement.
If you found something that could weaken our security, tell us privately.
Describe the affected system, the behavior you observed, how it can be reproduced and the impact you believe it creates. We will use that information to investigate the security issue and determine the appropriate next step.