Report a Security Issue

If you have found a way to reach data you shouldn't, break something you shouldn't, or get into an account that isn't yours — please tell us. We would much rather hear it from you.

How to tell us

Email [email protected] with "Security" in the subject. Tell us what you found, where, and the steps to see it happen. A screenshot helps.

We're one person, so we won't answer in an hour — but we read everything, and we'll reply within a few days to say we've got it and what we're doing about it.

What we promise you

If you report something in good faith, and you followed the two rules below, we will not come after you. No lawyers, no complaint to your employer, no report to law enforcement. You did us a favor and we'll treat it that way.

We'll also credit you by name here if you'd like us to, and say no if you'd rather stay quiet. Your call, either way.

The two rules

• Don't touch anyone else's data. If a hole lets you see another customer's order or address, stop there. Prove it to yourself, not to us — we'll take your word for what's behind the door.
• Don't break the shop for anyone. No load testing, no junk runs, nothing that takes the site down or fills the inbox. There is one of us, and it's a real business with real orders in it.

Especially interested in

• Anything that reaches another person's account, orders or address
• Anything that lets a price or an order total be changed
• Anything that gets into the admin side of the shop
• Anything that sends mail that looks like it came from us

What we can't do

We don't pay bounties. We're a small-batch skincare shop, not a software company, and we'd rather be honest about that up front than have you spend a weekend on it expecting a check. What we can offer is a fast thank-you, a credit line here, and the fix actually getting made.

Already known

Nothing outstanding at the moment. When something is reported and confirmed, it will be listed here once it's fixed.