Security & responsible disclosure
Report a potential security issue directly to HammerProof.
Responsible disclosure
Send the affected URL, a description, minimal reproduction steps and potential impact to [email protected]. Avoid including personal data, secrets or unnecessary sensitive evidence. Do not disrupt systems or access information beyond what is needed to demonstrate the issue.
Assessment boundaries
This public website does not run scans or accept domain submissions. VECTOR is a separate product; confirm its passive and active assessment scope and authorisation requirements with the team before use.
Procurement enquiries
Ask the team for confirmed hosting regions, encryption controls, data retention, subprocessors and deletion arrangements. No unverified EU-residency or encryption claims are made here.
Security contact
The security contact is also available at /.well-known/security.txt. An acknowledgement or response-time commitment has not yet been agreed.