Current safeguards
The current website and tracking endpoint include several baseline safeguards, including HTTPS delivery through the hosting platform, request validation, bounded request-body handling, origin checks for tracking requests, rate limiting, concurrency limits, no-store responses for tracking lookups, and browser security headers. These controls are implementation details, not a guarantee that the service is free of vulnerabilities.
Report a vulnerability
If you believe you have found a security issue, email [email protected] with the subject “Responsible security disclosure”. Include the affected URL, a clear description and steps to reproduce. Redact personal information and never include real tracking numbers belonging to other people.
Responsible testing
Please do not access, modify, delete or download data that does not belong to you; disrupt the service; perform denial-of-service testing; use social engineering; or test third-party carrier systems without their permission. Stop testing once you have enough evidence to explain the issue.
Response
We will review reports in good faith and may ask for reasonable clarification. We cannot promise a specific response time, bounty, public acknowledgement or safe-harbor arrangement. Please allow us reasonable time to investigate and address a verified issue before public disclosure.
Security status
ExportFlow does not currently claim ISO 27001 certification, SOC 2 attestation or an independent penetration-test certification. We will publish such claims only if a qualified independent body has completed the relevant assessment.