Report a vulnerability responsibly.
If you believe you found a security issue affecting ScratchSignal, describe the affected URL, the observed behavior, reproducible steps, and the potential impact. Do not include passwords, payment-card data, private ticket records, or another person's personal information.
How to contact us
Send the report to hello@scratchsignal.win with “Security report” in the subject.
Safe testing
- Use only accounts and data you control.
- Do not perform denial-of-service, automated high-volume scanning, social engineering, spam, or physical attacks.
- Do not access, alter, retain, or disclose another person's data.
- Stop testing and report promptly if you encounter sensitive information.
What to expect
ScratchSignal will acknowledge a complete report as reasonably practicable, investigate in good faith, and prioritize remediation based on reproducibility and impact. This policy is not a promise of a reward and does not authorize testing that violates law or affects other people or systems.