If you believe you have found a vulnerability in Surnet’s systems, reporting it to us helps our security. We will not take legal action against researchers who follow the rules below.
Scope
- surnet.com.tr and subdomains
- Customer portal and API endpoints
Rules
- Do not exfiltrate data or access or modify user data.
- Do not run tests that disrupt service (DoS, heavy automated scanning).
- Social engineering and physical attacks are out of scope.
- Do not share the issue with third parties until it is fixed.
Reporting
Send your finding with reproduction steps and evidence to guvenlik@surnet.com.tr. We confirm within two business days and share a remediation plan within 30 days. Contributing researchers are listed in our hall of fame.