Responsible Disclosure Policy

Security & Vulnerability Reporting · Last Updated: October 20, 2026 · Applies to: All Web & API Infrastructure

At Gig Earnings Guide (gigearningsguide.com), we take the security of our website, infrastructure, and user community seriously. We welcome feedback and contributions from independent cybersecurity researchers, ethical hackers, and technology enthusiasts who help us keep our platform safe.

Safe Harbor Guarantee:
If you conduct vulnerability research in good faith and in line with this policy, we consider your actions authorized. We will not start civil or criminal legal action against you. We will not ask law enforcement to intervene.

1. Rules of Engagement (Guidelines)

To qualify for safe harbor protection and help our security team, you agree to:

  • Notify Us Promptly: Report any potential security vulnerability as soon as you discover it.
  • Protect User Privacy: Make every reasonable effort not to access, view, modify, download, or destroy any other user's personal data, orders, or license keys. If you accidentally access personal data, stop testing and report it immediately.
  • No Service Disruption: Do not take actions that degrade user experience, crash servers, or disrupt availability.
  • Maintain Confidentiality: Do not publicly disclose the vulnerability or share it with third parties until our team has investigated it, addressed it, and confirmed the fix (coordinated disclosure).

2. Prohibited Testing Techniques

Strictly Out of Scope:
  • Denial of Service (DoS / DDoS) attacks or resource exhaustion attempts.
  • Automated brute-forcing or credential-stuffing against login/license activation endpoints.
  • Phishing, spear-phishing, or social engineering targeting administrators or shoppers.
  • Physical attacks against data centers, employees, or hosting hardware.
  • Attacks targeting third-party infrastructure directly (e.g., attacking Paddle.com payment servers or Cloudflare edge nodes).

3. In-Scope Targets

  • Primary web domains and subdomains (e.g., gigearningsguide.com).
  • Public web reader endpoints, HTML client applications, and JavaScript logic.
  • Content Security Policy (CSP), Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF) defenses.

4. How to Report a Vulnerability

Please send detailed reports to our security email:

Security Email: gigearningsguide@gmail.com

In your submission, please include:

  • A clear description of the vulnerability and its type (e.g., XSS, CORS misconfiguration).
  • Step-by-step reproduction instructions or a minimal Proof of Concept (PoC).
  • The affected URL, parameter, or HTTP request headers.
  • Your assessment of the potential real-world risk or impact.

5. Response Timelines & Recognition

We commit to handling security reports responsibly:

  • Initial Acknowledgment: Within 48 hours of your submission.
  • Triage & Assessment: Within 5 business days.
  • Remediation: We work to patch high-severity issues as quickly as possible.
  • Recognition: We do not currently run a paid (monetary) bug bounty program. However, we are happy to publicly credit you in our Security Hall of Fame for valid, novel, and impactful vulnerabilities reported ethically.