Report Security Issues

Last updated: October 7, 2026.

If you believe you have found a security vulnerability on Heretro.com, report it privately to contact@heretro.com.

What to include in a report

Use the subject line “Security report — Heretro.com”. Include the affected page or feature, a description of the issue, its potential impact and clear steps that allow us to reproduce it. Screenshots may help, but remove passwords, customer information and other sensitive data.

If your investigation accidentally exposed data or interrupted a service, explain what happened in your report without including the exposed private data.

Responsible disclosure rules

1. Give us reasonable time to review and address the issue before sharing details publicly.
2. Do not access or modify another person’s account or information without the owner’s consent.
3. Make a good-faith effort to avoid privacy violations, data destruction or disruption of service.
4. Do not exploit an issue for another purpose or attempt to compromise additional sensitive data.
5. Follow applicable laws and regulations.

When these rules are followed, we do not initiate a lawsuit or law-enforcement investigation in response to a good-faith report under this responsible-disclosure policy.

Review and discretionary rewards

Reports are prioritized according to risk and impact. Review times may vary. A report must identify a reproducible security or privacy risk; an ordinary website bug does not automatically qualify.

Discretionary rewards are available up to $200 for critical, $100 for high and $50 for medium severity vulnerabilities. Reward decisions depend on impact, reproducibility and report quality. Reporting an issue does not guarantee payment.

For duplicate reports, the first report we can fully reproduce is considered. Multiple findings from the same underlying cause are treated as one issue. We reserve the right to publish reports and to update the program.

Customer account and order issues

For a payment error, order question or account-access problem, use our Contact Us page so the request can be handled as customer support.