Security and vulnerability reporting policy
Scope and process for reporting security issues safely and helping prevent harm to users.
Based on the currently public HyunTools services. We update this policy and security.txt when the reporting scope, contact method, or security features change.
Purpose of this policy
HyunTools takes the safety of user data and the Service seriously. This policy explains the reportable scope, prohibited testing, and expected process so potential vulnerabilities can be reported safely.
Reportable scope
You may report technical security issues found in these official HyunTools services.
| Target | Scope |
|---|---|
| Official Service | https://hyuntools.com and the pages and APIs it provides |
| Help Center | Features provided directly by HyunTools at https://help.hyuntools.com |
| Accounts and authorization | Google sessions, age protection, per-user data access, and administrator checks |
| Storage | Hyun Library files, synchronized data, and account isolation for documents, code, and workspaces |
| Public features | Security of anonymous forums, votes, views, reports, and input processing |
Use the provider's own reporting process for systems operated directly by Google, Cloudflare, OpenAI, or a browser vendor.
High-priority vulnerabilities
- Authorization failures that expose another user's files, documents, code, schedules, or account data
- Session forgery or theft, authentication bypass, or administrator privilege escalation
- Code injection that can execute on a server or in another user's browser
- Unintended exposure of secrets, access tokens, or personal data
- Server-side request forgery, SQL injection, path manipulation, or download authorization bypass
- Bypassing protections so a user under 14 can participate in restricted features
An automated scanner result, security-header suggestion, or software version alone may not establish a vulnerability. Include the actual impact and reproduction conditions.
Safe verification
If you discover an issue accidentally or verify it non-destructively within your own account and data, stop testing and report it. Follow these rules.
- Use only accounts and data you own or have explicit permission to test.
- Make the minimum requests needed to establish the issue. Do not cause harm or seek additional access.
- If another user's data appears, do not read, copy, change, or delete it; stop immediately.
- Do not retain, share, or publish tokens, personal data, files, or internal information obtained.
- Do not publish technical details before a fix or disclosure date has been coordinated.
Get written permission by email before automated scanning, penetration testing, bulk requests, or active exploitability testing.
Prohibited testing
- Service disruption
- DDoS, load testing, request flooding, storage exhaustion, or reducing availability
- Social engineering
- Phishing, impersonating operators or users, requesting credentials, or deceiving people to gain access
- Data breach
- Viewing, extracting, changing, or deleting another user's data; downloading their files; or attempting account takeover
- Persistent access
- Installing a backdoor, uploading malware, maintaining access, damaging logs, or evading detection
- Physical or third-party attacks
- Attacking operator devices or accounts or testing Google, Cloudflare, OpenAI, or other third-party infrastructure
- Coercive reward demands
- Using a vulnerability to demand money, service access, or another benefit
How to report and what to include
Email hyuntools.owner@gmail.com with a subject such as “[Security vulnerability] Brief issue summary.”
- The exact affected URL, page, or feature
- The vulnerability type and expected security impact
- Minimal reproduction steps
- Browser, operating system, test environment, and occurrence time
- A screenshot or request evidence with secrets and personal data removed
- A contact email and whether you want public acknowledgement
Do not attach actual passwords, full session cookies, Google tokens, another user's personal data, or original files. We can coordinate a safer delivery method if needed.
What happens after a report
| Stage | Process |
|---|---|
| Acknowledgement | When possible, we confirm receipt within seven days. |
| Initial review | We assess reproducibility, impact, and urgency and may request more information. |
| Mitigation and fix | We may first restrict a feature, block access, or change settings, then implement and verify the underlying fix. |
| Outcome | When contact is possible, we share the finding or fix status to the extent safe to disclose. |
Timing depends on complexity, provider coordination, and user impact. A fix or individual reward is not guaranteed for every report.
Coordinated disclosure and rewards
- Do not publish details before a fix or mitigation is ready.
- When disclosure is appropriate, we will coordinate impact, fix status, and timing where practical.
- Never publish another user's personal data, authentication information, or working exploit code, even after a fix.
- HyunTools does not currently operate a bug-bounty or monetary reward program.
- With the reporter's consent, meaningful contributions may be acknowledged by name or alias.
Account compromise and general security issues
If a Google account may be compromised, first review its password and security settings and revoke connected-app access. Signing out of HyunTools ends only the current device session.
Use forum reporting and the Community guidelines for spam, harassment, or exposed personal data. Use Report an issue for ordinary interface errors.
Contact and change history
- Security contact
- hyuntools.owner@gmail.com
- Standard security contact file
- /.well-known/security.txt
- Effective date
- August 7, 2026
We update this document and the standard security contact file when the service scope or reporting process changes.
Change history
- August 7, 2026: First published.