Report a security issue

In scope

• Event Registration, Module Store, Plugin Grabber, Theme Grabber, and all paid modules
• avdude.com and license.avdude.com
• Future AV Dude plugins and modules, from their first release

What to include

• The plugin or service and its version
• Steps to reproduce, or a proof of concept
• What an attacker could do with it
• How you’d like to be credited, if at all

What you can expect

• Acknowledgment within 3 business days
• An assessment and planned fix timeline within 10 days
• Updates as the fix progresses, and a note when it’s released
• Credit in the release notes, if you’d like it

Safe harbor

If you research and report a vulnerability in good faith and follow this policy, we will consider your research authorized. We will not take legal action against you or report you to law enforcement for it. Good faith means you:

• stay within the scope listed above;
• avoid accessing, changing or deleting data that isn’t yours, and stop as soon as you’ve confirmed the problem;
• don’t degrade or disrupt our services, including license.avdude.com, and don’t use social engineering, phishing or physical attempts;
• report the issue privately to security@avdude.com and give us a reasonable time to fix it before sharing it publicly (we aim for 90 days, or sooner once a fix is released).

If someone else takes legal action against you for research that followed this policy, we will make it known that your work was authorized by us.

This promise covers only AV Dude. We can’t grant permission on behalf of other companies whose services we use, such as our web host or PayPal. If you’re unsure whether something is in scope, email us before you test.

Please don’t

• Post details publicly before a fix is released
• Access, change or delete other people’s data
• Run denial-of-service attacks or automated scans against license.avdude.com

Report privately

Email security@avdude.com.