Report a vulnerability

What to include

• The host and page or endpoint affected
• Steps to reproduce the issue
• What an attacker could do with it
• Any proof-of-concept, kept minimal

Please do

• Test only against accounts and environments you own or were given
• Stop and report as soon as you can show the issue
• Give us reasonable time to fix it before disclosure

Please do not

• Access or change other users' data or lab environments
• Run denial-of-service or automated scanning at volume
• Use social engineering or physical attacks

In scope

didlab.org and its subdomains. Intentionally vulnerable targets inside CTF challenges and lab scenarios are part of the exercises and are out of scope, unless you can break out of the challenge into the platform itself.

Machine-readable contact details are published at /.well-known/security.txt.