Security & Vulnerability Disclosure
We take the security of our platform and the data of our clients seriously. If you believe you've discovered a vulnerability, we want to hear about it — and we commit to working with you in good faith.
Scope
In scope: The website served at https://prakanplan.com (and any production domain we point at it).
Out of scope:
- Third-party platforms (AIA Thailand systems, LINE OA, Instagram, Google Workspace) — please report those issues directly to the respective vendors.
- Social-engineering attacks against staff or clients.
- Physical security of any office or person.
- Denial-of-service tests at any volume that could degrade the service.
How to report
- Email [email protected] with a clear technical description, reproduction steps, and any proof-of-concept code or screenshots.
- Please give us a reasonable window (90 days is our default) to investigate and remediate before any public disclosure.
- Encrypt sensitive content if you can — PGP key available on request.
Safe Harbor
We will not pursue legal action against researchers who, in good faith, follow this policy: stay within the scope above, do not access or modify user data beyond what is strictly necessary to demonstrate the issue, do not degrade the service, and give us a reasonable disclosure window.
Rules of engagement
- Do not exfiltrate, retain, or share data belonging to other users.
- Do not interact with accounts that are not yours without explicit consent.
- Do not run automated scans that generate significant traffic — coordinate with us first.
- Stop testing and notify us immediately if you encounter any user data.
Acknowledgments
Researchers who report verified, in-scope vulnerabilities and follow this policy will be credited here with their consent. We are still building this list.
Contact
Security reports: [email protected] — General contact: see the homepage.