# Report a security problem

> Email team@noboringsites.com. There is no bug bounty and no separate disclosure address, and this page says exactly what we will and will not do.

Security and your data · noboringsites documentation · https://noboringsites.com/docs/security/report-a-security-problem/

---

If you have found something, email **team@noboringsites.com**. That is the only address, and a person reads it.

## What to send

Enough for us to reproduce it, and nothing more.

- **The URL** where you saw it.
- **What you did**, step by step.
- **What happened**, and what you expected instead.
- **A screenshot or a request log** if you have one.

## What we will do

Four things, and we will tell you when each is done.

- **Confirm we received it.**
- **Reproduce it**, and come back to you if we cannot.
- **Fix it**, and say when it shipped.
- **Credit you** if you want to be credited, or stay quiet about it if you do not.

## What we do not have

Said plainly rather than left to be inferred.

- **There is no bug bounty.** We do not pay for reports.
- **There is no separate security address**, no PGP key and no security.txt today.
- **There is no published response deadline.** We will not print one we cannot evidence.

## Please do not

Three things that turn a report into an incident.

- **Do not test against a customer's live site.** Ours is [noboringsites.com](https://noboringsites.com); a site we host for somebody else is theirs, not a target.
- **Do not run automated scanners** against a production surface.
- **Do not access, download or alter anyone's data** to prove a point. Describing the route is enough.

## If your own site has been attacked

Different problem, same address.

- **Email team@noboringsites.com** and say the site is compromised, not just broken.
- **If we host it, it is ours to fix.**
- **Change any password you shared with anyone** before you do anything else.