1. How the platform is built
This is a statement of practices, not a certification. I hold no third-party security certification and do not claim one.
- Payments are processed entirely by Stripe. Card numbers never reach my servers or database.
- Purchased files are stored in private storage and served only through short-lived signed download links.
- The site is served over HTTPS everywhere, with security handled at the hosting edge.
- Database access is protected by row-level security policies, so accounts can only read their own records.
- Administrative access is limited to me, the sole owner, on authenticated sessions.
- Incoming payment webhooks are signature-verified and processed idempotently so replayed events cannot duplicate orders.
2. Reporting a vulnerability
Email support@itsdad.io with the subject line "Security" and include what you found, where, the steps to reproduce it, and what impact you think it has. Please give me a reasonable window — 90 days is the norm — before disclosing publicly.
I will acknowledge your report, normally within 2 business days, keep you updated while it is being fixed, and credit you publicly if you want the credit.
3. Safe harbor
If you make a good-faith effort to follow this policy, I will not pursue legal action against you for your research, and I will treat your report as authorized under the Computer Fraud and Abuse Act and equivalent laws.
4. Testing rules
- Test only against your own account and your own data.
- Do not access, modify, delete, or exfiltrate anyone else's personal information — if you encounter it, stop and tell me.
- No denial-of-service, load, spam, or physical or social-engineering testing.
- No automated scanning that degrades the service for other people.
- Do not test third-party providers such as Stripe or the hosting platform under this policy; report those to them directly.
5. Rewards
There is no funded bug bounty program. This is a one-person business, so I cannot promise payment. Serious findings get public credit and, where I can, a thank-you in the form of lifetime product access.
6. If something happens
If a breach affects your personal information, I will notify affected people and the relevant authorities as required by law, and I will tell you what happened in plain language rather than a press release.
Contact
Security reports — email support@itsdad.io. I read and answer that inbox personally, normally within 2 business days.
ITS DAD LLC · South Carolina, United States · https://itsdad.io