We welcome reports of vulnerabilities in pantheraproject.net and its tools.
How to report
Email [email protected] with a description, the affected URL, reproduction steps and the impact. A machine-readable contact is published at /.well-known/security.txt.
Scope
In scope: the website, /api/* endpoints, /go/* redirects, the DNS leak test service, and the ipv4./ipv6. lookup hosts.
Out of scope: denial-of-service testing, social engineering, physical attacks, and third-party services we link to.
Our commitment
- Acknowledge your report within five working days.
- Keep you updated and credit you (if you wish) once fixed.
- Not pursue legal action for good-faith research that respects user privacy, avoids data destruction and gives us reasonable time to fix the issue before disclosure.