Security

ProPage is a hosted service. If you have found a security issue in it, we want to hear from you. This page explains how to tell us and what happens next.

How to report a vulnerability

Email security@pro.page.

Please include:

• What the issue is, and the impact you believe it has.
• The steps to reproduce it, ideally with a specific URL or request.
• Anything needed to tell it apart from normal behavior, such as account state, plan, or timing.

What to expect

We will acknowledge your report within three working days. After that, we will keep you informed of what we find, and we will let you know when the issue is resolved.

ProPage does not run a paid bounty program.

Good-faith research

Research is welcome within these limits:

• Test only against accounts you control. Do not access, change, or keep another person's data. If you come across someone else's data, stop and report it.
• No denial of service, load testing, spam, or brute forcing against the live service.
• No social engineering of users or staff, and no physical attacks.
• Give us reasonable time to fix an issue before you disclose it publicly.

Out of scope

• Findings from automated scanners without a demonstrated, working impact.
• Missing security headers or cookie flags with no exploitable consequence.
• Vulnerabilities in third-party services that ProPage uses. Please report those to the vendor.
• Content that users publish on their own pages. See the next section.

Reporting a page, not a vulnerability

If a published ProPage page is abusive, illegal, or impersonates someone, that is a content report rather than a security report. Every published page has a Report this page link at the bottom. Use it, and the report reaches us directly and is handled as a separate process.