Vulnerability Disclosure Policy
Updated: October 2026
If you have found a security vulnerability in this site or its connected services, please report it. Good-faith research is welcome, and reports are handled quickly and openly. Machine-readable contact: /.well-known/security.txt (RFC 9116).
How to report
Email [email protected] with “Security” in the subject line. English or Turkish is fine.
Please include the affected URL or component, the type and impact of the issue, step-by-step reproduction (request/response samples, proof of concept) and how to reach you. If you need an encrypted channel, say so in your first email and we will set one up.
Scope
furkanisikay.com and its subdomains; the MCP server and site assistant API on mcp.furkanisikay.com (/ask, /ask/upload, /ask/brief); furkanisikay.com.tr (redirects only).
Of particular interest in the assistant: access to another visitor’s data or files, bypassing quota and budget protections, forging the signed history or file IDs, using tools outside their purpose, and triggering email or WhatsApp sends without verification.
Out of scope
Denial of service (DoS/DDoS), load and volume testing; calling the assistant repeatedly (every call has a real cost); social engineering, phishing and physical attacks.
Third-party services (Google Workspace, Cloudflare, Anthropic, Web3Forms, softivation.com): please report those to their own programs.
Automated scanner output without demonstrated impact; missing headers or best-practice findings without a concrete exploit path; clickjacking on pages without sensitive actions; self-XSS; SPF/DMARC/DKIM configuration suggestions; prompt injection that only changes the text output in your own session with no further impact.
Rules of engagement
Test only with your own account and your own data. If you come across someone else’s data, stop, do not keep it and report it right away. Do not degrade the service or modify or delete data; use the minimum interaction needed to confirm the issue. Do not disclose publicly before a fix is in place.
Response times
You will get an acknowledgement within 3 business days and an initial assessment with a severity within 10 business days. You will be kept informed while the fix is in progress. The target for coordinated disclosure is 90 days; if the fix ships sooner, we can disclose sooner together.
Safe harbor
Good-faith research that follows this policy is considered authorized: no legal action will be taken or complaint filed against you. If a third party takes action, they will be told that you followed this policy. If you are unsure whether something is in scope, ask first.
Recognition
There is no paid bug bounty. The first reporter of a valid, in-scope issue is thanked by name on this page, with their permission.