Security & disclosure

If you have found a vulnerability, we want to hear from you before anyone else does.

Reporting

Email hello@crawlpriceindex.com with enough detail to reproduce the issue. Machine-readable contact: /.well-known/security.txt.

What we commit to

Acknowledge your report within 3 working days.
Tell you our assessment and intended fix within 10 working days.
Credit you in the changelog if you would like to be named.
Never pursue legal action against good-faith research that follows the guidance below.

What we ask

Give us 90 days before public disclosure.
Do not access, modify or exfiltrate data belonging to other people.
Do not degrade the service — no denial-of-service, no high-volume automated scanning.
Do not use social engineering or physical attacks.
We are a one-person operation with no bug bounty budget. We can offer credit and gratitude, not cash.

How the service is secured

All secrets (payment keys, signing keys, list secrets, admin tokens) are stored encrypted in Cloudflare and are never committed to source control.
Paid data is gated on a per-customer key, rate-limited monthly, and watermarked per customer so any leak is traceable.
Subscription and alert links are HMAC-signed, so they cannot be forged or enumerated.
Stripe webhooks are signature-verified with replay protection.
Our own crawler signs every outbound request (RFC 9421 / Web Bot Auth), so sites can verify that traffic claiming to be ours is ours. Public key directory: here.
We store no page content from crawled sites, and no payment card data at any point.

Known limitations

This is a small, independent operation. We do not currently offer SSO, audit-log export, an uptime SLA or a signed DPA beyond our processors' standard terms. If you need those, email us and say so — it tells us what to build next.