Reporting a security issue

We check other people's forms for a living, so we take reports about our own systems seriously. If you found a vulnerability in formexposed, please tell us before anyone else.

How to report

Write to security@formexposed.com. Please include the affected address or component, the steps to reproduce it and what an attacker could do with it. A short report is fine – we will ask if we need more.

What we promise

We confirm your report within three working days and keep you informed until it is fixed.
We fix serious issues as fast as we can and tell you when the fix is live.
If you want, we name you on this page once the issue is fixed.

Please

only test with your own account and your own websites;
access no more data of others than you need to show the issue, and delete what you saw;
no denial of service, load tests or high-rate automated scans;
no spam, social engineering or physical attacks;
give us reasonable time (we suggest 90 days) before you publish anything.

Good faith

If you follow these rules, we will not take legal action against you for your research and will not report you to the authorities.

Scope

In scope: formexposed.com, form.exposed, the formexposed WordPress plugin, the TYPO3 extension and the behaviour of our scanner (formexposed-bot).

Usually out of scope, unless you show a concrete impact: missing security headers, SPF/DMARC settings, clickjacking on pages without actions, version numbers, self-XSS.

We are a small company and do not pay bounties – but we are grateful for every report.