Reporting a vulnerability
If you believe you have found a security vulnerability in PatchScope, please email security@evoa.one. Do not report security issues through public GitHub issues, pull requests or social media.
Our security.txt file is published at /.well-known/security.txt.
A good report includes:
- A description of the issue and its potential impact.
- The affected URL, endpoint or file in the repository.
- Step-by-step reproduction instructions, including any requests or payloads used.
- The date you found the issue and whether you have shared it with anyone else.
- How you would like to be credited, if at all.
Scope
In scope
- The website and its endpoints at patchscope.evoa.one.
- The code in the PatchScope GitHub repository.
Examples of issues we want to hear about:
- Bypasses of the website scanner’s SSRF protections, such as reaching private, internal or special-use addresses, non-default ports, or bypassing redirect validation.
- Cross-site scripting (XSS) or other injection issues in the site or tool output.
- Exposure of data that should not be accessible, including scanner response bodies or cookie values.
- Authentication or authorization issues in any account or access features we may add in the future.
- Ways to use the scanner to cause significant harm to third-party sites beyond its documented behavior.
Out of scope
- Volumetric denial-of-service attacks or load testing.
- Social engineering, phishing or physical attacks.
- Reports generated by automated scanners without a demonstrated, realistic impact.
- Missing best-practice headers or configuration without a working exploit.
- Vulnerabilities in third-party services we use, such as Cloudflare or Google. Please report those to the respective vendor.
- Issues that require a compromised device or browser, or unrealistic user interaction.
Rules of engagement
When researching PatchScope, please:
- Do not destroy, modify or degrade data or service.
- Do not access, retain or share data belonging to other users or third parties. If you encounter such data, stop and report it.
- Do not perform denial-of-service testing or generate excessive traffic. Respect the rate limits.
- Do not use the scanner against websites you are not authorized to test, including when demonstrating an issue. Use domains you control.
- Give us reasonable time to investigate and fix the issue before any public disclosure.
Our commitments
- Acknowledgement: we aim to acknowledge reports within 5 business days.
- Assessment: we will investigate, keep you informed of progress and let you know if we need more information.
- Remediation: we aim to fix critical issues within 30 days. Less severe issues are addressed according to impact.
- Coordinated disclosure: we will agree a disclosure timeline with you and, with your permission, credit you for the finding.
These are targets, not guarantees. PatchScope is maintained by a small team.
After you report
Once a report is acknowledged, we will:
- Reproduce the issue and assess its severity and impact.
- Tell you whether we accept it as a vulnerability, and if not, why.
- Develop and deploy a fix, and ask you to confirm it if you are willing.
- Agree a date for public disclosure. Where it helps other users, we may publish a short summary of the issue and the fix in the repository.
Please keep the details confidential until the agreed disclosure date. If we stop responding or cannot agree a timeline, contact us again at security@evoa.one before disclosing.
Safe harbor
We will not pursue or support legal action against anyone for security research conducted in good faith and consistent with this policy. Good-faith research means you make every effort to avoid privacy violations, data destruction and service disruption, you report findings promptly, and you do not exploit an issue beyond what is necessary to demonstrate it. If in doubt about whether an action is acceptable, ask us first at security@evoa.one.
This safe harbor applies only to PatchScope systems within scope. It cannot authorize testing of third-party systems.
Bug bounty
We do not currently offer monetary rewards for vulnerability reports. We are glad to acknowledge researchers who help improve PatchScope, if they wish.
Vulnerabilities in PHP or WordPress
PatchScope reports on known vulnerabilities but does not handle vulnerabilities in PHP, WordPress or other third-party software. Please report those directly to the responsible project:
- PHP: see the php-src security policy or email security@php.net.
- WordPress core: see WordPress security and the WordPress HackerOne program.
- WordPress plugins and themes: contact the author or vendor directly.
If you find an error in our advisory data rather than a vulnerability, use the contact page instead.