Security Research Policy

Purpose

This document explains the rules we follow when poking at third-party systems for security research. We want to be completely transparent with system operators about what we are doing, why we do it, and how you can tell us to stop.

Why We Wrote This

We want you to know who is hitting your servers. We believe in operating openly. If you see our traffic, you should be able to:

• Easily spot our research in your logs
• Contact us if something looks wrong
• Tell us to back off and opt out entirely

How We Operate

When we conduct research, we stick to these hard rules:

• Strict Rate Limiting: We throttle everything. We don't want to accidentally DoS your systems.
• Clear User-Agents: Our requests explicitly say what we are doing in the User-Agent header.
  Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 [Security Researcher: Tom Kristian Abel; +https://proksiabel.ee/disclosure]
• Custom Headers: We throw in extra headers so you can easily filter us out.
  X-Security-Scanner: ProksiAbel-SecurityResearch-2026
X-Contact: security@proksiabel.ee
• How to Tell Us to Stop: If you want us out of your logs, just:
  • Block our IP ranges entirely
  • Disallow: / to your robots.txt
  We respect these blocks automatically. No questions asked.
• We Don't Exploit: We look, but we don't touch. No unauthorized access attempts, ever.
• Zero Footprint: We aim to leave absolutely no mess behind.

Did you see us in your logs?

If you saw our traffic and hate it, just block our IP or drop us in your robots.txt. We will stop immediately. If you're worried about what we found or just want to yell at us, send an email. We actually reply.

Contact

Got questions about a scan? Need to talk to us about your systems? Reach out:

• Email: security@proksiabel.ee (Use PGP, please)
• Phone: +372 56666981

Company Details

PGP Key for Encrypted Comms

Acknowledgments

We respect the hacker community. If you found a bug in our own infrastructure, let us know via email. Responsible disclosure is always welcome.