Skip to content
Log in

Where to?

See plans Log in

Security

Found a security problem in Ext Watch? Thank you. Here is how to tell us and what happens next.

How to report

Email support@extwatch.com with “Security” in the subject. Please include:

  • what you found, and where (the page, address or endpoint);
  • the steps to show it, with any request or screenshot that helps;
  • what someone could do with it;
  • how to reach you, and the name to credit, if you’d like credit.

Plain email is fine. You don’t need PGP or any other encryption. Please don’t put other people’s data in the report; a short description is enough.

What happens next

  • We reply within 3 working days to say we have it.
  • We send a first assessment within 10 working days.
  • While we fix it, we update you at least every 2 weeks.
  • We tell you when it’s fixed, and credit you if you’d like.

We don’t run a paid bug bounty.

In scope

  • extwatch.com and app.extwatch.com, including sign-in, billing pages and the API.
  • The MCP server at app.extwatch.com/api/mcp and its sign-in (OAuth) endpoints. See the MCP docs.
  • Our emails and the links in them.

Out of scope

  • Services we use, such as our hosting, database, payment and email providers. Please report to them directly.
  • The Chrome Web Store and the extensions listed on Ext Watch. Report those to Google or the extension’s publisher.
  • Denial of service, load tests, spam, social engineering and physical attacks.
  • Scanner output, missing headers or best-practice notes with no working impact.
  • Our usage limits and bot checks working as intended.

Safe harbour

If you act in good faith and follow the rules below, we won’t take legal action against you or ask anyone else to, and we’ll treat your research as allowed. If someone else brings a claim about research that followed these rules, we’ll say so.

  • Use only your own account, or test accounts you made.
  • If you reach data that isn’t yours, stop, tell us, and don’t keep or share it. Look only as far as you need to show the problem.
  • Keep testing gentle: no degrading the service, no bulk copying of our data, and stay within your plan’s limits.
  • Give us a fair chance to fix it before you tell anyone else. We suggest 90 days, or sooner once fixed.
  • Don’t ask for payment in exchange for the details.

This doesn’t cover breaking the law, and we can’t speak for other companies.

Other reports

To report a leaked Ext Watch key, misuse of Ext Watch data or copies of our data, write to support@extwatch.com. For anything else, use the support page.

This policy is also published as security.txt.