Security and vulnerability reporting

1. Reporting

Email fulani.dev@gmail.com with the affected URL or API, reproducible steps, likely impact, and safe proof. Do not send passwords, one-time codes, a full database dump, or other people's personal data. We will acknowledge and begin triage of a critical report within 24 hours.

2. Safe research

Do not affect availability, use social engineering, establish persistence, change other users' data, or extract more information than strictly necessary to prove the issue. Stop if personal data appears and notify us. Load testing requires prior written permission.

3. Controls in use

Production traffic must use TLS. Sessions use a short-lived access token and protected HttpOnly refresh cookie; sensitive actions require fresh email verification. Controls include rate limiting, access separation, security headers, log minimization, rotating backups, and managed secrets.

4. Incidents

We contain the incident, preserve necessary evidence, assess affected data, and notify users, regulators, and affected providers within applicable deadlines. An incident involving Quran.Foundation APIs or data will be reported without undue delay with a target initial notification within 24 hours.

• Contact