Security & responsible disclosure
Found a security issue in UniSub? Thank you for telling us first. Here is how.
How to report
Email the details to the address below. Include steps to reproduce, the URL or app screen, what you expected and what actually happened. Screenshots or a short recording help.
security@unisub.inWe aim to acknowledge every report within 48 hours and will keep you informed while we look into it.
What we ask
Test only against accounts and stores you own or have permission to use. Do not access, change or delete other people’s data, and stop as soon as you have enough to demonstrate the issue.
No denial-of-service, spam, social engineering of our team or merchants, or physical attempts on our infrastructure.
Give us reasonable time to fix the issue before sharing it publicly.
What you can expect
We will not take legal action against researchers who follow this policy in good faith. We do not run a paid bounty programme today; with your permission we are happy to credit you once the issue is fixed.
This policy is also published in machine-readable form at /.well-known/security.txt.