🧩 Corrplus Responsible Disclosure Program — Terms of Use

Effective Date: October 2025
Last Updated: October 14, 2025

1. Purpose

At Corrplus, security is a top priority.
We recognize the valuable role that independent security researchers and ethical hackers play in identifying vulnerabilities that help keep our ecosystem secure.

This Responsible Disclosure Program outlines how you can report potential security vulnerabilities in a safe, lawful, and responsible manner.

2. Scope

This program applies to all Corrplus platforms and subdomains, including but not limited to:

  • corrplus.net

  • store.corrplus.net

  • support.corrplus.net

  • account.corrplus.net

  • docs.corrplus.net

The program covers any vulnerabilities that could compromise the confidentiality, integrity, or availability of Corrplus systems, data, or users.

3. Principles

By participating in Corrplus’s Responsible Disclosure Program, you agree to follow these core principles:

  • Act responsibly and in good faith.

  • Do not exploit or misuse any discovered vulnerabilities.

  • Avoid accessing, modifying, or deleting data that does not belong to you.

  • Do not disrupt Corrplus systems, services, or user operations.

  • Provide sufficient details to reproduce and validate the vulnerability.

Corrplus reserves the right to determine which submissions qualify as valid reports.

4. In-Scope Vulnerabilities

Examples of valid, in-scope findings include:

  • Cross-Site Scripting (XSS)

  • Cross-Site Request Forgery (CSRF)

  • Remote Code Execution (RCE)

  • Authentication or session management flaws

  • SQL injection or insecure direct object references

  • Sensitive data exposure

5. Out-of-Scope Findings

The following are out of scope and not eligible for acknowledgment or recognition:

  • Denial-of-service (DoS) or brute-force attacks

  • Social engineering or phishing attempts

  • Issues related to third-party integrations (e.g., Freemius, Stripe, WordPress.org)

  • Outdated browsers or plugins

  • Publicly available or already known vulnerabilities

6. Reporting Process

If you believe you’ve discovered a security vulnerability, please report it responsibly via our secure disclosure channel:

📧 security@corrplus.net

Your report should include:

  • A clear and detailed description of the issue

  • Steps to reproduce the vulnerability

  • Affected domain or endpoint

  • Screenshots or proof-of-concept (if applicable)

  • Your preferred contact method for follow-up

We will review all reports within 5 business days and respond with the status and next steps.

7. Our Commitment

Corrplus is committed to:

  • Reviewing and verifying reported vulnerabilities promptly

  • Maintaining open and respectful communication

  • Taking corrective actions within a reasonable timeframe

  • Acknowledging contributors who responsibly disclose valid issues (with consent)

While Corrplus does not currently operate a formal bug bounty payment system, we recognize valuable submissions and may offer discretionary rewards, acknowledgments, or partnership opportunities.

8. Legal Safe Harbor

We will not pursue legal action against individuals who:

  • Act in good faith and comply with this policy

  • Report vulnerabilities responsibly and confidentially

  • Do not exploit or publicly disclose issues prior to remediation

However, any activity that intentionally harms Corrplus users, infrastructure, or data may result in legal consequences.

9. Data Protection and Confidentiality

All information you share with Corrplus under this program will be handled confidentially and in accordance with:

  • General Data Protection Regulation (GDPR)

  • Turkish Personal Data Protection Law (KVKK)

  • Corrplus Privacy Policy

We ask that you also treat any information about Corrplus systems as confidential and do not disclose it publicly without written permission.

10. Communication and Recognition

Corrplus values community collaboration and transparency.
If your report is verified, and you wish to be publicly acknowledged, your name or alias may be listed on our Security Hall of Fame page.

We believe in celebrating responsible contributors who help strengthen our ecosystem.

11. Updates to the Program

Corrplus reserves the right to modify or discontinue this Responsible Disclosure Program at any time.
Changes will be reflected on corrplus.net/about/responsible-disclosure with the updated effective date.

12. Contact

For questions or clarifications related to this policy, please reach out to:

📧 security@corrplus.net
🌐 www.corrplus.net
🏢 Corrplus Digital Technologies — Registered in Türkiye & EU

🔐 Summary

Corrplus stands for trust, integrity, and transparency.
Through this Responsible Disclosure Program, we aim to build a safer digital ecosystem in collaboration with the global cybersecurity community.

Together, we make technology stronger. 💪