Security and vulnerability reporting

We take the security of our site and the privacy of its visitors seriously. If you find a vulnerability, please tell us first. We will work to fix it and thank you publicly if you wish.

How to report

• Write to us by email.
• Include the link or page, the steps to reproduce the issue, its expected impact, and a screenshot if you can.
• We reply within five working days and keep you updated until the report is closed.

Scope

• In scope: baladbytes.com and its pages, and the product-photo upload endpoint.
• Out of scope: third-party platforms such as TikTok, Instagram, WhatsApp and Cloudflare. Please report to them directly.

What we ask of you

• Do not access other people’s data, or keep it longer than needed to prove the issue.
• Do not attempt denial of service, spam or social engineering.
• Do not upload real malicious files to the site. A harmless test file is enough.
• Give us reasonable time to fix the issue before making anything public.

What we commit to

• We will take no action against you as long as you follow this policy in good faith.
• We name the first person to report a real vulnerability in the thanks list below, if they wish.
• We do not offer financial rewards at this time.

How we protect the site

• Every connection is encrypted, and browsers are required to use the encrypted connection only.
• A strict content security policy blocks any code from outside the site from running in its pages.
• No tracking or advertising tools, and no cookies for those purposes.
• Product photos are shrunk in the browser, each file is checked to be a complete image carrying no code, kept behind a private random link, served in an isolated sandbox, and deleted after 30 days.
• A limit on how many requests one connection can make, to prevent abuse.
• Check for yourself: Mozilla Observatory and Security Headers.

Thanks

No reports yet. Your name could be the first one here.

This page follows the international security.txt standard. Last updated: 12 October 2026.