Pitpage
Security
Last updated: 26 October 2026
If you find a security problem in Pitpage, tell us. We will work with you to fix it, and we will not take legal action against research done in good faith under this policy.
How to report
Email info@pitpage.app with “Security” in the subject. Describe the problem, the steps to reproduce it and what an attacker could do with it. Please give us a reasonable time to fix it before you tell anyone else.
In scope
- pitpage.app and its theme store
- app.pitpage.app: sign-in, the panel, the editor and the member area
- Team sites on *.pitpage.app
- The Pitpage Discord bot
Out of scope
- Denial of service, load and stress testing
- Social engineering or phishing of Pitpage users or of whoever runs Pitpage
- Problems in Cloudflare, Discord, Google or Resend themselves: report those to them
- Findings from automated scanners without a working proof
Good faith
Only test with accounts and teams that are yours or that you have permission to use. Do not read, change or delete other people's data; if you reach it by accident, stop and tell us. Do not slow the service down for anyone else.
What we do
We confirm we received your report, keep you updated while we fix it, and thank you by name when the fix is out, if you want that. Pitpage has no paid bug bounty.
How Pitpage protects accounts
Pitpage never stores a password: you sign in with Google, Discord or a one-time email code. Sessions live in cookies that scripts cannot read, on app.pitpage.app only, and every page is served over HTTPS.
security.txt
The same contact is at /.well-known/security.txt.