Security
Report a security issue.
If you found a problem with blitzhash.com, tell us. We would rather hear it from you first.
How to report
Send a short note by email.
Email assist@blitzhash.com with the subject “Security report”. Include the page or address, the steps to reproduce it, and what you saw. A screenshot or a short note is enough. Please do not include other people's personal data.
We aim to reply within 3 business days, and to tell you when it is fixed. Our contact details are also in security.txt.
Scope
What is in scope.
- blitzhash.com and its pages, forms and API routes.
- The free tools on this site: the self-check and the leak check.
Not in scope: other people's apps (including ones you test with the leak check), third-party services we link to (Calendly, Cloudflare, Supabase, Vercel), denial-of-service or load testing, spam or social-engineering of our team, and physical access.
Good faith
What we will not do to you.
If you act in good faith, we will not pursue action against you for research on blitzhash.com that stays in scope. Good faith means: you only touch what you need to show the issue, you do not read, change or keep other people's data, you do not disrupt the site, and you give us a reasonable chance to fix the problem before you share it.
We do not run a paid bounty. We will credit you if you would like that.
More on how we handle security and email is on the trust page.