How to report
Email support@traffic.cx with “Security report” in the subject. Describe the problem, the affected address, the steps to reproduce it and the impact you expect. A short proof of concept helps; screenshots or a video are welcome.
Please do not include passwords, private keys or other people’s personal information. If a report needs sensitive detail, say so and we will agree a safer way to share it.
In scope
These services are in scope:
- traffic.cx: the website, documentation and the tracking script under traffic.cx/js/
- app.traffic.cx: the dashboard, including shared dashboard links
- api.traffic.cx: the dashboard API, the Stats, Sites, Events and Payments APIs, sign-in and webhooks
- The event collector behind traffic.cx/api/event
Out of scope
These are not covered by this policy. Reports about them are still read, but please do not test them:
- Denial of service, load or volume testing, and anything that degrades the service for others
- Social engineering, phishing, or physical attacks against people, offices or hosting providers
- Services we use but do not run, such as Cloudflare, Google, Hostinger, Resend or Dodo Payments; report those to their owners
- Other applications that share our hosting provider
- Findings from automated scanners without a demonstrated impact
- Missing best-practice headers or settings, without a way to exploit them
- Rate limits that are merely higher than you would like
- Self-XSS, clickjacking on pages with no sensitive action, and logout or other low-impact cross-site requests
Rules for testing
To stay within this policy, please:
- Use only accounts, teams and sites you own or have created for testing. Never access, change or delete another customer’s data.
- If you reach someone else’s data or a system you should not, stop, do not keep or share the data, and tell us what you accessed.
- Keep automated requests to a few per second, and stop if you notice the service slowing down.
- Do not use what you find beyond what is needed to show the problem, and do not plant persistent code or back doors.
- Do not try to read our server files, environment, databases or other internal systems once you have shown that you could.
- Keep the details private until we have fixed the problem, or until 90 days after your report, whichever comes first. If a fix needs longer, we will tell you why and agree a date with you.
Safe harbour
We consider security research that follows this policy to be authorised. If you make a good-faith effort to follow it, we will not take legal action against you or ask the police to, and if a third party takes action against you for that research, we will make it known that you acted with our permission.
If you are unsure whether something you plan to do fits this policy, ask us first at the address above. This policy does not let you break any law, and it cannot give permission on behalf of other companies.
What we will do
We aim to confirm that we received your report within five working days, to keep you updated while we investigate, and to tell you when the problem is fixed.
traffic.cx is run by one person and does not offer a bug bounty or payment for reports. With your permission, we are happy to thank you by name once the problem is fixed.