Scope
In scope: mrooi.com and its subdomains, the free tools, and the lead form API. Out of scope: client websites (report those to the client), third-party services we use, denial-of-service testing, social engineering, physical attacks, and spam or rate-limit findings without security impact.
How to report
Email security@mrooi.com with the affected URL, steps to reproduce, impact and your contact details. Our security.txt file is at /.well-known/security.txt.
Our commitments
- We acknowledge within 3 business days and keep you updated at least every 14 days.
- We aim to fix critical issues within 30 days.
- We will not take legal action against good-faith research that follows this policy, avoids privacy violations and service disruption, and gives us reasonable time to fix the issue before disclosure.
- With your permission, we credit you once the issue is fixed.
Please do not
Access, change or delete data that is not yours; keep data you encounter; or test against client sites.