Responsible Disclosure Policy

We build white-hat security tools, so we hold ourselves to the same standard we ask of our users: if you find a security vulnerability in White Defender itself — not in a site or project someone scanned with it, but in our own application or infrastructure — we want to know, and we’ll work with you in good faith to fix it.

In scope: the White Defender web application and its API endpoints.

Out of scope: findings produced by White Defender’s scanners about a third-party site or codebase (report those to the owner of that site or codebase, not to us); social engineering or physical attacks against WMAD staff; denial-of-service testing.

Email business@thewmad.com with a description of the issue, steps to reproduce, and its potential impact. Please do not include real third-party secrets or personal data in your report.

We will not pursue legal action against researchers who discover and report a vulnerability in good faith, in accordance with this policy, and who do not access, modify, or exfiltrate data beyond what’s necessary to demonstrate the issue.

We aim to acknowledge reports within 5 business days and to keep you updated as we investigate and remediate. We’re a small team building this platform, so response times may vary — thank you for your patience.