Vulnerability Disclosure Policy

We take the security of Printbox and our customers' data seriously. If you believe you have found a security vulnerability in a Printbox system, please let us know. This policy explains what is in scope, how to report an issue and what you can expect from us.

Scope

getprintbox.com and its subdomains
The Printbox editor, Printbox APIs and other applications operated by Printbox

Out of scope

Online stores operated by our customers on their own domains, unless the vulnerability is in a Printbox component
Third-party services and platforms we use
Social engineering, phishing and physical attacks against Printbox staff or offices
Denial of service, load or volumetric testing
Automated scanning that degrades service for other users
Reports about email configuration only (SPF, DKIM, DMARC) or about spam
Missing security headers or best practices without a demonstrated impact
Clickjacking on pages without sensitive actions

How to report

Send your report to security@getprintbox.com. Please include:

the affected system or URL,
a description of the vulnerability and its potential impact,
steps to reproduce it, ideally with a proof of concept,
how we can contact you and whether you want to be credited.

You can write in English or Polish.

What you can expect from us

We will acknowledge your report within 3 business days.
We will send you our initial assessment within 10 business days.
We will keep you informed while we work on a fix.
If you wish, we will credit you once the issue is resolved.

Safe harbor

If you act in good faith and follow this policy, we will not take legal action against you for your research. In return, we ask you to:

access, modify or download only the minimum data needed to demonstrate the vulnerability,
stop testing and report to us right away if you come across personal data or other confidential information,
not use, keep or share any data you obtain,
give us reasonable time to fix the issue before disclosing it publicly. By default we follow coordinated disclosure with a 90-day window, which we can agree to adjust together.

Rewards

We do not run a bug bounty programme and do not pay monetary rewards. We are grateful for every report and are happy to acknowledge your contribution.