Reporting
Email hello@crawlpriceindex.com with enough detail to reproduce the issue. Machine-readable contact: /.well-known/security.txt.
What we commit to
- Acknowledge your report within 3 working days.
- Tell you our assessment and intended fix within 10 working days.
- Credit you in the changelog if you would like to be named.
- Never pursue legal action against good-faith research that follows the guidance below.
What we ask
- Give us 90 days before public disclosure.
- Do not access, modify or exfiltrate data belonging to other people.
- Do not degrade the service — no denial-of-service, no high-volume automated scanning.
- Do not use social engineering or physical attacks.
- We are a one-person operation with no bug bounty budget. We can offer credit and gratitude, not cash.
How the service is secured
- All secrets (payment keys, signing keys, list secrets, admin tokens) are stored encrypted in Cloudflare and are never committed to source control.
- Paid data is gated on a per-customer key, rate-limited monthly, and watermarked per customer so any leak is traceable.
- Subscription and alert links are HMAC-signed, so they cannot be forged or enumerated.
- Stripe webhooks are signature-verified with replay protection. Blockchain payments are verified on-chain, and each transaction can be redeemed only once.
- Our own crawler signs every outbound request (RFC 9421 / Web Bot Auth), so sites can verify that traffic claiming to be ours is ours. Public key directory: here.
- We store no page content from crawled sites, and no payment card data at any point.
Known limitations
This is a small, independent operation. We do not currently offer SSO, audit-log export, an uptime SLA or a signed DPA beyond our processors' standard terms. If you need those, email us and say so — it tells us what to build next.