Reporting a Security Issue
If you notice a security issue affecting almousa.dev, please send a private report to:
contact@almousa.dev
Suggested subject: Security Report — almousa.dev
Email is the preferred reporting method. Reports may be submitted in Arabic or English.
Scope
This policy covers the hostname almousa.dev only. It does not automatically include subdomains, including www.almousa.dev, client websites, third-party services, or any other domain.
Useful Information to Include
- The affected URL or function.
- A clear description of the issue and its potential impact.
- Safe, limited steps to reproduce the issue.
- When the issue was observed and any technical details needed to understand it.
- Redacted screenshots, if needed, without personal data or secrets.
Do not send passwords, access keys, or other people’s data. If an investigation requires sensitive information, we will coordinate an appropriate way to transfer it.
Responsible Conduct
This policy is a reporting channel, not general permission to scan or penetration-test almousa.dev or any other system. Obtain written authorization specifying the assets, methods, duration and testing limits from the authorized owner before active testing.
Do not disrupt services, modify or delete data, bypass permissions, access other people’s data or use social engineering. If sensitive data appears unintentionally, stop and report only what is necessary without downloading or sharing it.
We coordinate disclosure to protect users and allow assessment and remediation, without restricting reports to competent authorities or statutory obligations.
Acknowledgment and Follow-up
We acknowledge receipt of reports within 3 business days. We may request additional information to verify a report. Remediation timing depends on severity, impact, and the complexity of the fix. The acknowledgment period is not a promise to complete remediation within the same timeframe.
The acknowledgment timeframe does not postpone legally required notifications to competent authorities or affected individuals following a personal data breach.