Security Policy

Last updated: 16 October 2026 · Version 2026-09-21

1. How to report

Send your report to keironjwest@gmail.com. Please include:

• a description of the issue and the affected URL, endpoint or feature;
• clear steps to reproduce (a short proof of concept is ideal);
• the impact you believe it has;
• your name or handle if you want credit, and how to reach you.

If you need to send sensitive details, ask us first for a secure way to do so. A machine-readable contact is also published at /.well-known/security.txt.

2. Scope

In scope: the Binder Blitz website and app at https://www.binderblitz.com, its API endpoints and the tools we host (Theme Builder, Image Studio) – for example authentication or authorisation flaws, injection, exposure of other users’ data, insecure direct object references, payment or credit-logic flaws, and flaws in file upload handling.

Out of scope: the infrastructure and services of our providers (Supabase, Render, Stripe, NOWPayments, Anthropic, Cloudflare and others; report those to the provider); social engineering or phishing of our staff or users; physical attacks; denial-of-service or volumetric testing; automated scanner output without a demonstrated impact; missing best-practice headers without a concrete exploit; and issues affecting only outdated browsers.

3. What not to do

• Do not access, change or delete data that is not yours. If you find you can reach other people’s data, stop and tell us straight away.
• Do not degrade the service: no denial-of-service, spam, or heavy automated scanning.
• Do not use social engineering, or attack our providers or other users.
• Do not exploit a vulnerability beyond the minimum needed to prove it, and do not use it to obtain free credits or services.
• Do not publicly disclose the issue until we have had a reasonable chance to fix it (please allow up to 90 days, or agree a date with us).

4. Safe harbour

If you make a good-faith effort to follow this policy, we will treat your research as authorised, will not pursue or support legal action against you for it, and will work with you to understand and resolve the issue. This does not give permission to breach anyone else’s rights or to break the law in a way that harms others, and it does not bind third parties such as our providers, but we will say you acted in good faith if asked.

5. What to expect

• We acknowledge your report within 3 business days.
• We will assess it, tell you whether we agree it is a valid issue, and keep you updated on progress.
• We aim to fix confirmed issues promptly, prioritised by severity, and tell you when done. This is a solo-run product, so please be patient with timing.
• With your permission we will credit you when we publish a fix.

6. Rewards

We do not run a bug bounty and cannot offer payment for reports. We are grateful for responsible reports and will thank you publicly if you wish.

7. If your data is affected

If a security incident affects personal data, we will notify the relevant authority within 72 hours of becoming aware where the law requires it, and tell affected users without undue delay. See the Privacy Policy for how we protect data.