Security and vulnerability disclosure

Updated 24 October 2026

If you find a vulnerability in this service, please email security@primedevforce.com with steps to reproduce. We aim to acknowledge reports within 3 business days. Our security.txt has the same contact.

In scope

• primedevforce.com and its /api/ endpoints
• Ways to make the scanner reach private, internal or metadata addresses (SSRF), bypass rate limits, or inject content into reports

Please don't

• Run denial-of-service or volumetric tests
• Access other people's data, or use the scanner against systems you don't own
• Use social engineering or physical attacks

Safe harbor

We won't pursue action against good-faith research that follows this policy, avoids harm, and gives us reasonable time to fix issues before disclosure.

How we protect the scanner

Every target hostname is resolved before it is contacted, and the scan is refused if any address is private or reserved. Redirects are followed by our own code, at most 5, and each hop is re-validated. Only ports 80 and 443 are used. Requests time out and response bodies are capped. Reports are rendered as plain text, never as HTML.