// Disclosure

Reporting security issues in SmashPanel and Smash Hit Hosting

Found a security issue? Here is how to tell us, and what we ask of you.

How to report

Email security@smashpanel.com with steps to reproduce, affected URLs and impact. You can also use security@smashhithosting.com. Both addresses are listed in security.txt.

Response

We reply to every report and keep you updated until it is fixed.

In scope

smashpanel.com, smashhithosting.com, panel.smashhithosting.com and the SmashPanel software.

Out of scope

Denial of service, volumetric testing, social engineering, physical attacks, spam, missing best-practice headers without demonstrated impact, and other customers' websites.

Rules

Only test against accounts you own. Do not access, modify or keep other customers' data. Stop and report if you encounter it. Allow 90 days, or until a fix ships if sooner, before public disclosure.

Safe harbour

We will not take legal action for good-faith research that follows this policy.

Rewards

There is no paid bug bounty.