Security Vulnerability Reporting

1. Report privately

Email iga.africa@keplercollege.ac.rw with the subject “Security vulnerability”. Include the affected host or app version, clear reproduction steps, expected impact, and supporting screenshots or logs with secrets removed.

Do not post an unresolved vulnerability publicly or send passwords, access tokens, private keys, full personal records, or malicious payloads by ordinary email.

2. Safe research boundaries

• Use only accounts and data you own or are expressly authorized to test.
• Stop immediately if you encounter another person's information and report only the minimum evidence needed.
• Do not use denial of service, destructive testing, social engineering, spam, malware, physical attacks, or automated activity that degrades the service.
• Do not change, download, retain, disclose, or exploit data beyond what is strictly necessary to demonstrate the issue.

3. What to expect

We will triage good-faith reports, may ask for clarification, and will prioritize remediation according to risk. We cannot promise a particular resolution date or payment. IGA Africa does not currently operate a public bug-bounty program.

We ask reporters to allow a reasonable remediation period before any coordinated disclosure. This policy does not authorize conduct prohibited by law or access beyond these boundaries.