Vulnerability disclosure policy

Effective

Security is the point of , so we welcome reports from security researchers. If you think you’ve found a vulnerability, please tell us so we can fix it.

How to report

• Use the report form and choose “A security vulnerability”, or
• email (see also our security.txt).

Include what you found, where, how to reproduce it, and the impact you think it has. Screenshots or a short proof of concept help. Don’t include other people’s data.

What we promise

• We’ll acknowledge your report within 3 working days and keep you updated.
• We’ll aim to fix serious issues within 30 days and tell you when it’s done.
• We’ll credit you on request once it’s fixed.
• If you follow this policy in good faith, we won’t take legal action against you or ask anyone else to, and we’ll treat your research as authorised.

In scope

• and its pages, including the Workbench, account pages and free tools;
• our database functions and server functions, as reached through the site.

Out of scope

• Paddle’s checkout, Supabase’s and Cloudflare’s own platforms: report those to them;
• denial of service, load testing, spam or social engineering of our staff or customers;
• missing best-practice headers or settings with no demonstrated impact;
• findings from automated scanners without a working example.

Please don’t

• access, change or delete data that isn’t yours: use two test accounts of your own instead;
• degrade the service for other users;
• publish details before we’ve fixed the issue or 90 days have passed, whichever is sooner, unless we agree otherwise.