Scanning ethics and responsible disclosure
Last updated November 6, 2026
Draft. To be reviewed with counsel before launch.
We test other people’s websites for a living, so we hold ourselves to clear rules about how we do it and what we do with the results. This page also explains how to report a problem in our own site.
How we test stores we don’t work for
- Passive only. Without a contract we load public pages and run public searches, as any visitor can. We don’t log in, create accounts, submit forms, place orders, scan ports, probe for vulnerabilities or try to get around bot protection.
- Light. One request at a time with pauses between them. The free check stops at 60 requests and follows robots.txt.
- No customer data. We don’t collect personal information about a store’s customers, and we stop and delete anything we see by accident.
- Anything more needs permission. Testing beyond public pages happens only with the owner’s written authorization naming the scope.
What we do with what we find
- Private. Findings about a named store go only to that store, to someone who can act on them. We don’t post them publicly, share them with competitors or use them to pressure anyone.
- Re-checked. We re-run a finding within seven days before we send it, because stores change.
- Factual. We describe what happened with evidence: dates, visitor profile, screenshots or recordings. We don’t say a store broke the law, put a fine on it, or set deadlines.
- Free to act on. You can fix anything we send without hiring us. Saying no, or not replying, ends the conversation.
- Anonymized in studies. Our public studies don’t identify the stores tested. A named case study needs written permission.
- Security problems are different. If we notice something that looks like a security flaw rather than a configuration choice, we report it privately to the store’s security contact (or its
security.txt), don’t try to exploit or confirm it further, and don’t sell anything off the back of it.
If you received a note from us and want it withdrawn, your store removed from our lists, or your data deleted, email hello@ranktalos.com. We act within two business days.
Reporting a vulnerability in this website
Email security@ranktalos.com with what you found, the page or request involved, and steps to reproduce it. Our security.txt has the same contact.
We will acknowledge your report within three business days, keep you informed while we fix it, and credit you if you want. We won’t take legal action against good-faith research that:
- tests only ranktalos.com and its own accounts, not other people’s data;
- avoids privacy violations, data destruction and service disruption, including denial-of-service and spam;
- stops and tells us as soon as you reach data that isn’t yours; and
- gives us reasonable time to fix the problem before you share it.
We don’t run a paid bug bounty. Reports about missing headers with no demonstrated impact, or about third-party services we don’t control, are welcome but may not get a fix.