1. Reporting channel
Email admin@sitefueler.com with “Security report” in the subject. Include the affected URL or component, vulnerability type, prerequisites, minimal reproducible steps, likely impact, date observed and a safe proof of concept. State whether you accessed any information or changed any state.
Do not send a live exploit, malware, private key, full customer dataset or unnecessary personal information through ordinary email. Ask for a safer transfer method if sensitive evidence is genuinely necessary.
2. Good-faith research expectations
Act carefully, stop when sensitive data becomes visible, collect only the minimum evidence, keep the issue confidential while we investigate, and allow a reasonable remediation period. Use an account and data you own or are expressly authorized to use.
Complying with this policy is a factor SiteFueler will consider in treating research as good faith. This statement does not bind a third party or waive rights concerning conduct outside the policy.
3. Activities not authorized
- Denial-of-service, resource exhaustion, high-volume scanning or disruption;
- social engineering, phishing, impersonation or physical intrusion;
- accessing, copying, modifying or deleting another user’s data beyond the minimum accidental observation needed to show impact;
- changing orders, payments, refunds, downloads, tickets or account ownership;
- installing persistence, malware or a backdoor;
- testing an independent provider such as MilesWeb, Cloudflare, PayPal, PhonePe, Google, GitHub, Meta or Zoom without its permission;
- public disclosure or extortion before reasonable investigation and remediation; or
- using a vulnerability for financial gain, competitive intelligence or privacy invasion.
4. Examples generally worth reporting
- authentication or authorization bypass;
- access to another customer’s order, download, ticket or personal information;
- SQL injection, remote code execution or stored cross-site scripting;
- meaningful cross-site request forgery affecting a sensitive action;
- payment or signed-download bypass with demonstrable impact;
- exposed secrets controlled by SiteFueler;
- insecure direct-object references; or
- a configuration that creates a material confidentiality or account-takeover risk.
5. Issues generally not eligible without demonstrated impact
Version banners, missing best-practice headers, automated scanner output, clickjacking on a non-sensitive page, self-XSS, rate-limit suggestions, email spoofing without evidence, theoretical attacks, social-account enumeration with no risk, and vulnerabilities only in obsolete unsupported software may not require action. We still welcome a concise report if the real impact is unclear.
6. Our response
We aim to acknowledge a credible report within 3 business days, triage severity, request needed clarification, and keep the reporter reasonably informed. Remediation time depends on impact, reproducibility, dependencies and operational risk. We may coordinate with a plugin, hosting or service provider when the issue originates there.
SiteFueler does not currently operate a paid bug-bounty program. No payment is promised. We may offer acknowledgment, with the reporter’s permission, for a helpful and responsible report.
7. Coordinated disclosure
Do not publish technical details until SiteFueler confirms remediation or an agreed disclosure date arrives. We will consider a reasonable disclosure request and will not unreasonably delay discussion. User safety, provider coordination and availability of a fix take priority.
8. Privacy
Reporter details and evidence are used to investigate, communicate, remediate, establish or defend rights, and comply with law. We may share the minimum necessary information with affected infrastructure providers, developers, advisers or authorities. Do not include another person’s data unless strictly necessary.