Security & Vulnerability Disclosure

We take the security of our customers' advertising accounts and data seriously. If you believe you have found a vulnerability in AdControlCenter, we want to hear about it. This page explains what we consider in scope, how to report, and what to expect back.

No paid bounty

AdControlCenter does not operate a paid bug bounty program, and we do not offer monetary rewards for reports. We do offer prompt triage, a direct line to the engineer who will fix the issue, and — if you would like it — public credit once the fix has shipped. Please do not submit a report expecting payment or an invoice to be honoured.

How to report

Email security@adcontrolcenter.com. A useful report includes:

• The affected URL, endpoint, or component
• Clear reproduction steps, and the account you tested from
• A proof of concept — a request/response pair or a short screen recording
• What an attacker could actually achieve, in your assessment

Reports that consist only of automated scanner output, with no demonstrated impact, will be closed without detailed response.

In scope

• adcontrolcenter.com and www.adcontrolcenter.com
• The authenticated dashboard and its API routes under /api/
• The public plugin API under /api/plugin/
• Our WordPress / WooCommerce plugin, Creative Studio

Issues we care most about: tenant isolation failures (reading or writing another workspace's data), authentication or session flaws, server-side request forgery, remote code execution, injection, exposure of OAuth tokens or API credentials, and payment or entitlement bypass.

Out of scope

• Missing security headers, cookie flags, or TLS configuration nitpicks with no demonstrated exploit
• SPF, DKIM, or DMARC configuration, and email spoofing reports
• Clickjacking or CSRF on pages with no authenticated state-changing action
• Self-XSS, or issues requiring a compromised device, browser extension, or physical access
• Software version disclosure, banner grabbing, and directory listings without sensitive content
• Absence of rate limiting where no concrete abuse is demonstrated
• Denial of service, volumetric, or stress testing of any kind
• Social engineering of our team, customers, or vendors, and physical attacks
• Vulnerabilities in third-party services we rely on (Clerk, Supabase, Vercel, Lemon Squeezy, and the advertising platforms) — please report those to the vendor directly

Rules of engagement

• Test only against accounts and data you own. Create your own account for testing.
• Do not run automated scanners or fuzzers against our infrastructure.
• Do not access, modify, delete, or exfiltrate data belonging to anyone else. If you access someone else's data accidentally, stop immediately, do not save it, and tell us.
• Do not degrade the service for others, and do not attempt to pivot into internal systems.
• Do not publicly disclose the issue until we have shipped a fix, or 90 days have passed since your report, whichever comes first.

What to expect

• Acknowledgement of your report within 5 business days
• An initial assessment, including whether we consider it in scope, within 10 business days
• An update when the fix ships, and public credit on request

Safe harbor

If you make a good-faith effort to comply with this policy during your research, we will consider your activity authorised, we will not pursue or support legal action against you in relation to it, and we will help make it known that your actions were conducted in compliance with this policy if a third party raises the matter. If in doubt about whether a specific test is acceptable, ask us before you run it.

Machine-readable policy

This policy is referenced from /.well-known/security.txt per RFC 9116.