Nowhere obvious to report a flaw
A researcher has to guess which inbox to try, or gives up and posts the flaw publicly instead.
SECURITY · VULNERABILITY DISCLOSURE
Somewhere to send a real problem
A vulnerability disclosure policy is a stated way for someone who finds a security flaw to report it safely, and what happens after they do. Without one, a researcher who finds a genuine problem has to guess where to send it, or posts it publicly first.
A clear channel means a real flaw reaches the people who can fix it before it reaches anyone who would exploit it.
THE RANGE OF PRACTICE
What no channel looks like, and what a documented one looks like
Described by behaviour, not by a score.
An inbox exists, no stated process
A report can technically arrive, but nobody outside the organisation knows what happens to it next.
A clear channel and a stated response window
A researcher knows exactly where to send a report and roughly when to expect a reply.
HOW TO REPORT
Email hello@gigagrams.com with what you found
Include the affected system, the steps to reproduce it, and expected versus actual behaviour.
A report is read, acknowledged and acted on, within support hours (09:00–20:00 Gulf Standard Time) or immediately if it describes a critical issue. There is no paid bug bounty programme currently, a genuine report is still taken seriously and acted on regardless.
STRAIGHT ANSWERS
Questions about reporting a vulnerability
The ones that come up before anyone signs anything.
A stated way for someone who finds a security flaw to report it safely, and what happens after they do. It exists so a researcher who finds a real problem has somewhere to send it other than posting it publicly first, and so a business is not caught off guard by a stranger emailing a general inbox.
Email hello@gigagrams.com with what you found and how to reproduce it. Include the specific system affected. We reply within our standard new-enquiry window, or immediately if the report is marked urgent.
No. There is no paid bounty programme currently. A genuine report is still read, acknowledged and acted on, it is simply not compensated financially at this time.
The affected system or URL, the steps to reproduce the issue, and what you expected to happen versus what actually happened. A clear, reproducible report gets fixed faster than a vague one.
Send us your website address. We will tell you what is exposed.
The free technical audit covers security headers, plugin and theme inventory, known vulnerabilities and whether your admin login is publicly reachable. Two days, no charge, no obligation.