Rules

Report requirements

1. The incident must be real and have valid public evidence.
2. Submit the affected public page or proof file itself. Exploit/XSS/SQLi payload URLs are not accepted as evidence.
3. Automatic verification requires an exact visible attacker signature. Plain-text proof such as Hacked by attacker can be verified directly when the submitted attacker matches; HTML pages are also checked for page context so news/articles are not mistaken for defacements.
4. Do not attack systems to create evidence.
5. Pending targets are not published before verification.
6. Administrators may reject or remove risky reports.