KankorAsan keeps the study records of thousands of students. If you have found a weakness in how we protect them, we want to hear about it, and we will treat you as someone helping us, not as a threat.
How to report
Write to the address below with the word Security in the subject. Describe what you found, the page or app screen involved, and the steps to reproduce it. A screenshot or a short recording helps. Do not put other people's personal data in the report.
support@kankorasan.af
The same contact details are published in a machine-readable file for security researchers:
/.well-known/security.txt
What is in scope
Everything we build and run ourselves:
- The website at kankorasan.af and its subdomains
- The KankorAsan apps for Android and iOS
- The API that the website and the apps talk to
What is out of scope
- Denial of service, load testing, or anything that slows the service down for students
- Social engineering of our team or our students, phishing, and physical attacks
- Weaknesses in services we use but do not operate, such as Google sign-in or the app stores; report those to the vendor
- Automated scanner output with no demonstrated impact, and a missing best-practice header on its own
What we ask of you
- Test only with accounts you own. Never read, change or delete another person's data; if you reach it by accident, stop and tell us.
- Give us reasonable time to fix the issue before you publish anything about it.
- Do not make payment a condition of telling us. We do not run a paid bounty programme today, but we credit reporters who want to be named.
Safe harbour
If you follow these rules in good faith, we will not take or support legal action against you for your research, and we will work with you to understand and fix the issue.
How we respond
We acknowledge every report within 3 working days. Within 10 working days we tell you whether we have confirmed the issue and how we plan to fix it, and we keep you informed until it is resolved.
