Responsible Disclosure

#Status of this document

This policy is effective from 5 September 2026. The version and effective date shown on this page identify the applicable document. Publication of this policy does not extend testing authorization beyond the boundaries described below.

#Operator and reporting channel

PROVEN is operated by Adrian Popescu, an independent developer. Security vulnerabilities affecting systems controlled by PROVEN can be reported to contact@proven.ro.

Where possible without disclosing sensitive data, a report should include the affected service or URL, reproduction steps, observed impact, conditions required for reproduction, and contact details for clarification. Do not send passwords, API keys, tokens, merchant credentials, or copies of personal data that are not necessary for the report.

#Scope

This policy concerns surfaces and services operated or controlled by PROVEN. It does not authorize testing merchant stores, Shopify, external providers, or other third-party systems merely because they interact with PROVEN.

#Good-faith research boundaries

The following activities are not permitted by this policy:

• intentionally accessing, modifying, deleting, or exfiltrating another person’s or merchant’s data;
• obtaining or using secrets, tokens, API keys, or credentials that do not belong to you;
• denial of service, intentional availability degradation, flooding, spam, or volumetric testing;
• social engineering, phishing, impersonation, or requesting credentials from users or collaborators;
• persistence, pivoting to other systems, installing malware, or changes that survive the test;
• testing merchant or other third-party infrastructure without separate authorization from that party.

If a check exposes personal data, secrets, or access beyond what is strictly necessary to demonstrate the issue, stop the check and report the condition without expanding access.

#Handling process

PROVEN may acknowledge receipt, request additional details, reproduce the issue, assess impact, and communicate remediation or disclosure coordination. This policy does not establish a response-time SLA, a bug-bounty program, or an obligation to pay a reward.

#Public disclosure

To reduce risk to users, avoid publishing exploitable details before PROVEN has had a reasonable opportunity to investigate and, where applicable, remediate the issue. Any coordination remains subject to applicable law and third-party rights.