Report a security issue

If you think you have found a security problem in CatalogBadge, we want to hear about it. Email security@catalogbadge.com with the steps to reproduce it, what an attacker could do with it, and how you would like to be credited.

What we promise

• A reply within 3 business days, and news on our progress until the issue is fixed.
• No legal action against you for research that follows the rules on this page. If a third party complains about it, we will say that you acted with our permission.
• Credit on this page once the fix is live, if you want it.

We do not run a paid bug bounty today.

In scope

• catalogbadge.com, app.catalogbadge.com, feeds.catalogbadge.com and img.catalogbadge.com
• The CatalogBadge store apps and plugins (Shopify, Salla, Zid, YouCan, Wix, BigCommerce, WooCommerce, Magento) and the Chrome extension

Of most interest: reading or changing another customer's stores, feeds or images; getting into the admin; making our servers fetch internal addresses; forging a platform install or webhook; and anything that would put a wrong price on a customer's ad image.

Rules

• Test only with an account and stores you created yourself.
• If you reach another customer's data, stop, do not keep or share it, and tell us at once.
• No denial of service, load tests or high-volume scanning (keep it under 5 requests a second), no spam through our sign-in or contact forms, no social engineering of our staff or customers, and no physical attacks.
• Do not test the platforms we connect to (Shopify, Salla, Meta, Cloudflare, Dodo Payments and others) through us; report their issues to them.
• Keep the details private until we have fixed the issue, or for 90 days after your report, whichever comes first.

Usually not accepted

• Reports from automated scanners without a working proof of impact
• Missing headers, cookie flags or email records (SPF, DKIM, DMARC) without a working attack
• Clickjacking of pages with no action to take, self-XSS, logout CSRF
• Software version banners, and rate limits on actions that cost nothing

Thanks

Nobody yet. Yours could be the first name here.