Vulnerability Disclosure

Email security@amibeingpwned.com with a clear description of the issue, steps to reproduce, and your assessment of impact. You can encrypt your report using our PGP key:

In scope

• amibeingpwned.com and all subdomains - authentication, API endpoints, dashboard, and any customer-facing surface
• The Am I Being Pwned? browser extension (Chrome, Edge and Firefox) - data handling, permissions usage, communication with our backend
• The public API - authentication bypass, authorization flaws, data exposure across organization boundaries
• Our finding reports - if you believe we have published an inaccurate or misleading finding about an extension

Out of scope

• Third-party services we use, such as our subprocessors - report those directly to the vendor
• Denial of service attacks or volumetric testing of any kind - please do not attempt to take down or degrade our service during research
• Social engineering of our team or customers
• Physical security
• Issues requiring unlikely user interaction or that only affect outdated browsers
• Missing security headers or TLS configuration issues without a demonstrated impact
• SPF, DMARC, and DKIM configuration on domains we do not actively send email from
• Rate limiting issues that do not result in meaningful data exposure
• Theoretical vulnerabilities without a working proof of concept

• Do not perform DoS or load testing. We run a real production service with real customers. Any testing that affects availability or performance for others is outside this policy and may result in your IP being blocked.
• Do not run automated scanners at scale. Aggressive crawling or fuzzing tools that generate significant load are not permitted. Test manually or with targeted, low-volume tooling.
• Use a test account you own. Create a free account for your research. Do not test against other users' accounts or data, even to demonstrate a vulnerability.
• Do not access, modify, or exfiltrate data that is not yours. If you discover a vulnerability that would allow access to other users' data, demonstrate it against your own account and stop.
• Do not disrupt extension findings. If your research involves extensions we have analyzed, do not attempt to manipulate our scoring pipeline or inject findings.

• Within 48 hours - acknowledgment that we have received your report
• Within 7 days - initial triage, severity assessment, and confirmation of whether the issue is in scope
• Within 30 days for critical issues - target for a fix or mitigation to be deployed. We will let you know if a longer timeline is needed and why.
• Within 90 days for complex issues - for vulnerabilities requiring significant architectural changes, we aim to resolve within 90 days. We will coordinate a disclosure timeline with you.

We will keep you updated at each stage. If you have not heard from us within 48 hours, follow up at security@amibeingpwned.com.

We do not currently operate a paid bug bounty program. If you are looking for financial rewards, we are not the right target right now and we would rather you knew that upfront.

For valid, in-scope findings we offer:

• Public credit in any disclosure or post-mortem, if you want it
• A direct thank-you from the team for significant findings
• For critical findings that prevent real harm to our customers, we will consider other forms of recognition on a case-by-case basis - reach out and talk to us

We consider security research conducted under this policy to be authorized. We will not pursue civil or criminal legal action against researchers who:

• Follow the testing guidelines above
• Report findings to us before public disclosure and give us reasonable time to respond
• Do not access, modify, or destroy data belonging to other users
• Do not attempt to extort us or our customers

If at any point you are uncertain whether what you are doing is within scope, stop and email us before continuing.