Skip to content

✨ New One subscription for every core module and unlimited branches. Cancel within 14 days with a straightforward refund. Get started now

Legal

Vulnerability Disclosure

If you found a security vulnerability in Restoreks, this page explains how to report it and what we do after your report.

Last updated: 30 September 2026

1. How to report

Send the vulnerability you found by email to security@restoreks.com. We can confirm and fix the issue faster if the report includes:

  • The affected URL or endpoint (URL, API path, app and version)
  • Steps to reproduce the issue
  • The impact (whose data or actions could be reached)
  • A way for us to contact you

You can write your report in Turkish or English.

2. Scope

These services are covered by this policy:

  • restoreks.com (marketing website)
  • app.restoreks.com (admin panel)
  • pos.restoreks.com (POS)
  • portal.restoreks.com (customer portal)
  • menunuz.com and its subdomains (menu and ordering pages)
  • Restoreks mobile apps and the APIs they use

3. Out of scope

We do not assess reports about:

  • Denial-of-service attacks and load tests (DoS/DDoS)
  • Social engineering and phishing
  • Physical attacks
  • Spam
  • Reports from automated scanners without a demonstrated impact
  • Missing best-practice headers without a working exploit
  • Third-party services (payment providers, marketplaces)
  • DNS of customers' own custom domains

4. Rules

While researching, we ask you to follow these rules:

  • Test only on your own account.
  • Access no more data than needed to prove the issue; do not download, change or delete other people's data.
  • If you reach personal data, stop and tell us right away.
  • Do not disclose the issue publicly before it is fixed.
  • Do not leave persistent access or backdoors in our systems.

5. Our commitment

When you send a report, we do the following:

  • We reply within 3 business days to confirm we received it.
  • We keep you informed while we assess and fix the issue.
  • We fix the vulnerability according to its severity.
  • For research done in good faith and in line with these rules, we will not take legal action against you or file a complaint.

6. Acknowledgements

If you want, we list the name of the reporter on this page. The list is empty for now; it will appear here after the first valid report.

7. Rewards

We do not run a monetary reward program at this time. We thank you for your reports, but we do not pay for them.

8. Personal data (KVKK)

If a report involves personal data, we assess it under Turkish Law No. 6698 (KVKK) and notify the Personal Data Protection Authority and the data subjects when required.