Security and Responsible Disclosure

• All code changes are reviewed before they reach production.
• Dependencies are monitored for known vulnerabilities and updated on a regular schedule.
• Secrets such as API keys and credentials are kept out of source code and stored in encrypted secret stores.
• Development, staging, and production environments are separated, and production data is not used for testing.
• Input validation, output encoding, and parameterized queries are standard in our codebases.

• Traffic is encrypted in transit with TLS, and data is encrypted at rest where our providers support it.
• Access to systems follows the principle of least privilege and is reviewed regularly.
• Multi-factor authentication is required for administrative and internal accounts.
• Systems are monitored and logged so we can detect and investigate unusual activity.
• Backups are taken regularly and restore procedures are tested.
• We select infrastructure and software providers with recognized security practices and review them over time.

Everyone who works with us is bound by confidentiality obligations. Access is granted only for the work a person is doing and is removed promptly when it is no longer needed. Security and privacy are part of how we plan, review, and hand over every project.

For client engagements we agree on security requirements early, including data classification, hosting location, access, and compliance needs. We sign data processing agreements where we handle personal data on a client's behalf and can align with a client's own security policies and questionnaires.

If we detect a security incident, we act to contain it, assess its impact, fix the cause, and learn from it. When personal data is affected, we notify the competent authorities and affected individuals as required by law:

Clients are informed without undue delay of any incident that affects their data or systems, as agreed in their contracts.

If you believe you have found a security vulnerability in one of our systems, please email [email protected] with the subject line "Security report". Please include:

• The affected domain, URL, or component
• A description of the issue and its potential impact
• Steps to reproduce it, with a proof of concept if possible
• How we can contact you for follow-up questions

We will acknowledge your report within 3 business days, keep you informed of our progress, and let you know when the issue has been resolved.

This policy covers the following domains and their subdomains: hafetech.net, mcpcore.io, aviclass.com, and kargorasyon.com.

The following are out of scope:

• Denial of service and load testing
• Social engineering, phishing, and physical attacks
• Systems and services owned by third parties, including our hosting and SaaS providers
• Reports generated only by automated scanners without a demonstrated impact
• Missing security headers or best practices without a demonstrated security impact
• Self-XSS, clickjacking on pages without sensitive actions, and similar low-impact issues

• Only test against accounts and data you own or have explicit permission to use.
• Access only the minimum data needed to demonstrate the issue, do not modify or delete data, and stop as soon as you confirm the vulnerability.
• Do not degrade the availability of our services or affect other users.
• Keep the details confidential until we have fixed the issue, or for 90 days after your report, whichever comes first, unless we agree otherwise.

If you act in good faith and follow this policy, we will consider your research authorized, will not take legal action against you, and will not ask law enforcement to investigate you. If a third party takes legal action against you for activity that complied with this policy, we will make it known that your actions were authorized by us. This commitment does not apply to activity that breaks the law or goes beyond what this policy allows.

We do not currently run a paid bug bounty program. With your permission, we are happy to publicly thank researchers who help us improve our security.

Our machine-readable security contact is published at https://hafetech.net/.well-known/security.txt. Service status for MCPCore is available at https://status.mcpcore.io.