Report a real issue without exposing real people.

How to report

Email contact@ml-boost.com with the subject “Pagewrite security report”. Include:

• the affected URL, endpoint, feature, or version;
• clear reproduction steps using a test account and fictional data;
• the observed and expected result;
• the realistic impact and any conditions needed to reproduce it;
• redacted screenshots, request/response fragments, or a minimal proof of concept; and
• how you would like to be credited, or that you prefer no credit.

Scope

In scope: hosted Pagewrite services and internet-facing assets owned and operated by ML BOOST under pagewrite.dev, including the public website and API.

Out of scope unless we give written permission:

• customer-run or on-premises installations not operated by ML BOOST;
• third-party services such as Google, Stripe, Mistral, Neon, PostHog, Telegram, or an issuing authority;
• social engineering, phishing, physical attacks, employee or contractor devices, and stolen credentials;
• denial of service, volumetric testing, spam, or tests that degrade availability;
• reports that only identify a missing best-practice header without a practical security impact;
• automated scanner output without validation; and
• issues in an obsolete local version that are not reproducible in the current hosted service.

Responsible testing rules

1. Use only accounts, files, and data you own or have explicit permission to test.
2. Use fictional form data. Do not seek, access, alter, retain, or download another user’s information.
3. Stop after the minimum proof needed to show the issue. Do not establish persistence, pivot, exfiltrate, or test production deletion.
4. Do not disrupt service, bypass payment for gain, create fraudulent documents, or generate material cost.
5. Do not publicly disclose details before we have had a reasonable opportunity to investigate and fix the issue.
6. Comply with the law and these rules. If you are unsure whether a test is safe, ask before performing it.

Good-faith research

To the extent within ML BOOST’s authority, we will not initiate legal action against a researcher for good-faith testing that follows this policy, avoids privacy harm and disruption, and promptly reports the issue. This statement does not authorise access to a third party’s systems, waive another party’s rights, or protect conduct that is extortive, reckless, unlawful, or outside this policy.

This is a vulnerability-disclosure route, not a bug-bounty programme. We do not promise payment, a reward, public credit, or a specific remediation deadline.

What happens after a report

We will try to acknowledge a credible report, assess severity and reproducibility, limit exposure, and communicate material status when practicable. Timing depends on complexity, provider involvement, and risk. We may ask for clarification or coordinate disclosure. Please do not treat silence as permission for broader testing.

ML BOOST decides whether and when a report can be publicly disclosed, acting reasonably and taking account of users and affected providers. We will not publish your identity without permission unless legally required.

Current security posture and claims

The hosted product uses authenticated access for protected endpoints, private client rules for public lead data, bounded input schemas and sizes, same-origin controls, server-side quotas for public launch forms, and short application-level retention for form sessions and outputs. Security controls and provider configuration vary by route.

Suspected privacy or account incident

If you believe your own account or personal data is affected, sign out, revoke exposed API keys where possible, preserve non-sensitive timestamps, and email contact@ml-boost.com. Do not include a completed form in the first email.

Privacy rights and personal-data breach handling are described in the privacy notice.