Reporting a security issue.

How to report

Email security@freewebstore.com. Reports are read by a person. Please send one issue per email and include:

• the affected URL or feature;
• the steps needed to reproduce it, written so that someone else can follow them;
• what an attacker could actually do with it — the real impact, not the theoretical one.

No bug bounty

Freewebstore does not run a bug bounty programme and does not pay for vulnerability reports. Reports are accepted on a goodwill basis only. We do not respond to messages asking whether we pay, and we will not engage with a report that makes disclosure conditional on payment.

What to expect from us

We read every report. We reply when we need more information, or when a valid issue has been fixed. We do not reply to automated scanner output, to out-of-scope reports, or to repeated follow-ups on either.

Testing in good faith

If you test our platform, you must:

• only test against a store and account that you created yourself;
• not access, change or delete data belonging to anyone else. If you come across someone else’s data, stop and tell us;
• not use denial-of-service, load testing, spam, social engineering or physical attacks;
• stop and report it once you have confirmed an issue exists, and not use it to go further;
• give us a reasonable time to fix it before telling anyone else.

Out of scope

We do not act on, or reply to, reports of the following:

• DNS and email configuration — DNSSEC, SPF, DKIM, DMARC, CAA and similar;
• missing security headers or cookie flags, without a working exploit;
• clickjacking on pages with no sensitive action;
• self-XSS, or script that only runs in files served from our file-storage and CDN domains, where there is no access to a logged-in session;
• missing rate limits, or brute-force reports with no demonstrated impact;
• software version or banner disclosure;
• usernames or passwords found in third-party breach or “stealer log” collections;
• output from automated scanners with no proof of concept;
• the content of individual stores. Each store is run by an independent merchant — to report a store, use our contact page;
• third-party services we use but do not operate.

Who you are dealing with

Freewebstore Ltd.
Slater Terrace,
On The Banks,
Sandygate,
Burnley,
Lancashire,
United Kingdom,
BB11 1BU