Found something in us? Tell us.

Contact email is pending. In the meantime, reach out via the form on /hack-me and mark the message as a security disclosure.

• The affected URL or component.
• A short description of the issue.
• Steps to reproduce, with enough detail that we can confirm.
• The impact you observed or believe is possible. Write it the way you’d explain it to a colleague.
• Your name and how you’d like to be credited, if at all.

• Acknowledge your report within two business days.
• Investigate and confirm the issue within a reasonable window.
• Fix it and tell you when it’s fixed (unless you ask us not to).
• Credit you in our security acknowledgements page if you’d like.

• Don’t access, modify, retain, or destroy data that isn’t yours.
• Don’t degrade the service for other users, or use social engineering against our team.
• Give us a reasonable window to investigate before any public disclosure.

In-scope: anything reachable at gethacked.ai, including our customer-facing form. Out of scope: third-party services we link to, automated scanners running against the site without a report attached, and physical attacks.