24/7 Support
Blog
SECURITY

Responsible Disclosure.

Found a security issue in a Ucartz system? Tell us first, test in good faith, and we will work with you to fix it, not against you.

Contents

Ucartz runs the hosting, VPS, dedicated server and client-area systems that our customers depend on. If you believe you have found a genuine security weakness in one of these systems, we want to hear about it directly, before it reaches anyone else. This page sets out what we ask of you, what you can expect from us, and the protection we offer security researchers who report in good faith.

1) Scope

This policy covers systems Ucartz owns and operates directly:

  • The main website, ucartz.com and its subdomains
  • The client area and billing system
  • Services and panels Ucartz hosts and manages directly for customers (where the vulnerability is in our own configuration or infrastructure, not in a customer's own application code)

If you are unsure whether a system is in scope, email us first and ask before testing.

2) How to Report

Email abuse@ucartz.com with a clear subject line starting "Security Report:", or open a ticket in the client area under the Abuse department. Do not use public channels, social media or GitHub issues to report a vulnerability. If the issue is sensitive, say so in your first message and we will agree a secure way to exchange further detail.

3) What to Include

A report we can act on quickly includes:

  • The affected URL, hostname, IP address or service
  • A clear, step-by-step description of how to reproduce the issue
  • The impact as you understand it (what an attacker could actually do)
  • Any proof-of-concept request, script or screenshot that does not itself cause harm or expose real customer data
  • Your contact details, so we can follow up and credit you correctly if you want that

4) Our Process

Once we receive your report, here is what happens:

  • Acknowledgement: We confirm we have received your report and that it is being looked at by an engineer, not just logged.
  • Triage: We reproduce the issue, assess its real-world impact, and work out which systems and customers it affects.
  • Fix: We prioritise a fix based on severity. Critical issues (data exposure, authentication bypass, remote code execution) are treated as urgent.
  • Update: We keep you informed of meaningful progress until the issue is resolved. We ask for your patience on timelines for complex fixes.

We do not commit to a fixed number of days for every report here, because severity and complexity vary too widely to promise one honestly; a critical issue gets urgent attention, and we will tell you directly where things stand if you ask.

5) Rules of Engagement

To keep your research in the good-faith category this policy protects, please:

  • Test only against your own account or test data, never a real customer's live data or service, unless you already have that customer's explicit permission
  • Stop and report as soon as you have enough evidence to demonstrate the issue; do not go further than necessary to prove impact
  • Never attempt to access, download, modify or delete data that is not your own
  • Do not run automated scanners or load-testing tools that could degrade service for other customers
  • Do not attempt denial-of-service, spam, social engineering of our staff or customers, or physical attacks on our facilities or data centres
  • Give us a reasonable chance to fix the issue before telling anyone else about it; please do not publish details until we confirm it is resolved

6) Out of Scope

The following are not useful reports under this policy:

  • Vulnerabilities in a customer's own website, application or server configuration, where Ucartz only provides the underlying hosting or VPS (report these to that customer directly)
  • Vulnerabilities in third-party services we link to but do not operate (payment processors, social media platforms, WHMCS itself as upstream software)
  • Missing security headers, SPF/DMARC tuning suggestions, software version disclosure, or other low-impact findings with no real exploitation path, reported without a working proof of concept
  • Reports generated purely by an automated scanner with no manual verification

7) Safe Harbour

If you make a good-faith effort to comply with this policy while researching and reporting a vulnerability, Ucartz will not pursue legal action against you for that research, and we will consider your access authorised for the purpose of this policy. This safe harbour applies only to testing that stays within the scope and rules above; it does not cover actions that access, damage or disclose real customer data beyond what is strictly needed to demonstrate the issue.

8) Recognition

We do not run a paid bug bounty programme and do not offer reward amounts for reports. A valid report that leads to a fix is verified and, with your permission, added to the public Hall of Fame below once the issue is resolved. A report is credited once; later reports from the same person are acknowledged privately rather than added again.

Hall of Fame

Our thanks to the following security researchers for their reports:

9) Contact

For a security report, or any question about this policy:

Thank you for taking the time to report responsibly. Reports like these make our service safer for every customer.