Report a vulnerability
Found a security bug? Tell us first. We reply within 72 hours.
72 h reply
Then updates until it's fixed.
Safe harbour
Good-faith research within these rules: no legal action from us.
No bounty yet
We're small, so no paid bounty for now.
In scope
- qodesign.dev and its pages
- Checkout and the download links
- Accounts, sign-in and /admin
- The free-code and contact forms
Out of scope
- ✕Other sites on the same servers
- ✕Stripe, Cloudflare and other vendors
- ✕Spam, DoS or load tests
- ✕Missing headers with no real impact
Please
Test on your own account
Never touch other people's data or orders.
No damage
No deleting, no service disruption, no social engineering.
Keep it private
Give us time to fix it before you tell anyone.
Send a report
Steps to reproduce help most. Or email [email protected].
Machine-readable: security.txt