Security

1. Responsible disclosure

Found a flaw in Shotbot: write to us before any public disclosure. Research carried out within the scope described on this page will never be held against you. A report is a service rendered, not an incident to pin on someone.

A useful report holds few things: the URL or API call involved, what was sent, what came back, and how that differs from what should happen. A reproducible curl command beats a long description. No form to fill in, no expected format.

2. Hosts in scope

Research is allowed on these hosts:

• www.shotbot.net and www.shotbot.fr, the public sites and account areas
• api.shotbot.net, the v2 API and the MCP server
• add.shotbot.net and update.shotbot.net, the v1 API
• cache.shotbot.net and static.shotbot.net, screenshot delivery
• ping.shotbot.net, ping.shotbot.fr and status.shotbot.net, service status

Out of scope, with no blame attached, simply with no follow-up: vendor services, Stripe, the host, the mail provider, which run their own channels. Internal administration, which is not exposed to the internet. And the third-party sites customers capture, which do not belong to Shotbot.

Automated scanner reports with no demonstrated impact get read and rarely acted on. Missing headers, advertised versions, TLS configuration grades: that category.

3. What you may do

• Test the hosts listed above.
• Create a free account for the occasion. Two, if account isolation is what interests you: both will be yours.
• Submit your own URLs for capture. test.shotbot.net and test.shotbot.fr exist for that, they are the house test targets.
• Ask for a higher quota if the test calls for one. The request goes to the same address.

4. What you may not do

• Degrade the service. Load testing, denial of service, bulk sending, altering or deleting data. A flaw is demonstrated on one case, not on a volume.
• Reach another account's data. If you run into some by accident, stop and say so: that is exactly the report expected. Keep nothing, publish nothing.
• Use the capture engine to reach a third party. The engine fetches pages on your behalf. Pointing it at a target you do not own falls outside the scope.
• Target people rather than the service. Phishing, social engineering, approaching vendors or customers.

These limits are not boilerplate. Past them, the cover described above no longer holds.

5. How it goes

The 72 hours are a commitment, not a target. Past that with no answer, consider your part done.

Shotbot is run by one person. A message that arrives on a Saturday night is read on Saturday night. A deep fix, on the other hand, can take longer than at a vendor with a team. Better said than discovered.

6. Reward

No bounty. Shotbot is run by a sole trader, and a reward program is beyond its means. Better said plainly: a "maybe" draws bounty hunters and scanner output.

What is on offer: your name, publicly, with the link of your choice, once the fix ships. Say so in your message. Staying anonymous is just as easy to ask for.

7. What protects the service

Without detailing what should not be detailed, here are the measures you will run into:

• Encrypted communications end to end (HTTPS/TLS, HSTS)
• Password hashing (bcrypt), sessions identified by a random token
• Payments delegated to Stripe, PCI-DSS Level 1 certified: no card data passes through Shotbot servers or is stored on them
• Private screenshots served by token, off the public CDN
• Administration not exposed to the internet, access by FIDO2 hardware key

Processing details and retention periods are in the privacy policy.