Security & Vulnerability Disclosure Policy

Last updated: June 2026

Castori Club welcomes reports from security researchers and members who discover vulnerabilities in our platform. This policy explains what is in scope, how to report a finding, and the commitments we make to researchers who act in good faith. It is the canonical policy referenced by our /.well-known/security.txt file (RFC 9116).

1. How to Report

Email [email protected] with a clear description of the issue. Please include:

• The vulnerability type and the affected URL, endpoint, or component
• Step-by-step instructions to reproduce, including any required accounts or roles
• A proof of concept (request/response, screenshot, or short video) where possible
• The potential impact as you understand it

We accept reports in English or Portuguese. We aim to acknowledge a report within 3 business days and to provide a remediation timeline after triage.

2. Scope

In scope:

• The Castori Club web application and its portals at castori.club
• The platform API served under /api
• Authentication, authorization, session handling, and multi-factor flows
• The engagement lifecycle, allocation cascade, and payout integration

Out of scope:

• Third-party services we integrate with (Stripe, Moloni, Autenticação.Gov) — report those to the respective vendor
• Findings that require physical access to a user's device or a compromised account the researcher does not own
• Volumetric denial-of-service, traffic flooding, or resource-exhaustion testing
• Reports from automated scanners with no demonstrated, exploitable impact
• Missing best-practice headers or weak TLS configuration on endpoints with no sensitive data, absent a concrete exploit
• Social engineering, phishing, or physical attacks against staff or members

3. Rules of Engagement

• Only test against accounts you own or have explicit permission to use
• Do not access, modify, or exfiltrate data that does not belong to you; stop at proof of concept
• Do not degrade service availability or impact other members
• Keep findings confidential until we have remediated and agreed on disclosure
• Comply with all applicable laws, including Portuguese and EU law

4. Safe Harbor

We consider security research and vulnerability disclosure conducted in accordance with this policy to be authorized. We will not pursue or support legal action against researchers who act in good faith, stay within the scope and rules above, and give us a reasonable opportunity to remediate before any public disclosure. If legal action is initiated by a third party against you for activity that complied with this policy, we will make this authorization known.

5. Coordinated Disclosure

We follow coordinated disclosure. Once a report is triaged, we will keep you informed of remediation progress and, where appropriate, credit you for the discovery. We ask that public disclosure be coordinated with us and not occur before a fix has shipped.

6. Contact