Found a security flaw in our website? Tell us.
If you've found a weakness in penguina.website, email us at hello@penguina.website. This page explains what you can test, what you can't, what to put in your report and what happens after you send it.
Send one email with what you found.
Email hello@penguina.website and put "Security report" in the subject line, so it doesn't get mixed up with everyday messages. A person on our team reads it.
What a good report contains
- Where: the full address of the page, or the part of the site, where the flaw is.
- What: what the flaw is, and what someone could do with it.
- How to see it: the steps to see it for yourself, with the browser or tool you used. A screenshot helps.
- How to reach you: a name or handle, and the email address we can reply to with questions.
Please describe any personal details or passwords you came across rather than copying them into your email.
What you can test, and what you can't.
Only our own website is in scope. The websites we look after belong to our clients.
In scope
- penguina.website and its pages, including this one.
Out of scope
- Any website we look after for a client. Never test those. If you think you've spotted a flaw on one, stop and email us what you saw.
- Anything that slows down or takes down a website, such as flooding it with traffic.
- Social engineering, such as phishing, or calling or messaging our team or our clients.
What happens next.
The same steps for every report.
A person reads it
Your email goes to our team inbox, and one of us reads your report.
We check it
We follow your steps on penguina.website to see the flaw for ourselves.
We may ask you
If something isn't clear, we reply to the address you wrote from.
We fix it
If the flaw is real, we fix it on our website.
Where do I send a security report?
Email hello@penguina.website with "Security report" in the subject line. A person on our team reads it.
Can I test a website that Penguina looks after?
No. Our clients' websites belong to them, not to us, so they are out of scope. If you think you've spotted a flaw on one, stop there and email us what you saw.
What is out of scope?
Any website other than penguina.website, including client websites. Also anything that slows down or takes down a website, and social engineering, such as phishing or calling our team or our clients.
What should a good report contain?
The page address, what the flaw is and what someone could do with it, the steps to see it for yourself, and how we can reach you with questions.
My own website has a security problem. Can you help?
Yes, that is the work we do. This page is only for flaws in penguina.website. For your own site, tell us in the chat or on WhatsApp, or read what to do if your website was hacked.