How to report

Use the enquiry form and pick "Vulnerability report". Tell us the affected address or system, the steps to reproduce the issue, what an attacker could do with it, and how to reach you. If you came across personal data, describe it rather than pasting it into the report.

What this policy covers

The policy covers shadowtracesolution.com and its subdomains, the domains shadowtrace.in and shadowtracesoulation.com (both redirect to shadowtracesolution.com), and the enquiry API at /api/contact.php. It covers no other systems.

Our clients' systems are outside it. We cannot authorise testing on systems we do not own, so report those issues to the owner.

Rules for testing

Do not run denial-of-service or load tests.
Do not phish, phone or otherwise social-engineer our people.
Send only the few test submissions you need through the contact form. Each one lands in a person's inbox.
Access only as much data as you need to show the problem, and stop as soon as you reach personal data. Do not keep, share or change any data.
Give us reasonable time to fix the issue before you publish anything. We will agree a date with you.

Reports we usually do not accept

Automated scanner output with no shown impact; missing headers or best-practice settings with no working attack; self-XSS; clickjacking on pages with no sensitive action; and SPF or DMARC suggestions without a working spoof.

What we do with your report

We confirm that we have your report within 7 days and keep you updated while we fix it. Once it is fixed we will credit you by name if you want that. We do not currently pay for reports.

Safe harbour

If you act in good faith and follow this policy, we will treat your research as authorised, we will not take legal action against you over it, and we will not report it to law enforcement. This applies only to Shadowtrace's own systems. We cannot give permission on behalf of anyone else.

Machine-readable contact

This policy is listed in our security.txt file (RFC 9116).

Vulnerability disclosure policy.