Report a vulnerability
Email: security@privacyscanpdf.com
Please include: a description of the issue, steps to reproduce (proof of concept), and any suggested mitigations. PGP-encrypted reports welcome (key available on request).
Our commitment to you
48-hour acknowledgment
We acknowledge receipt of your report within 48 hours.
5-business-day assessment
We provide an initial assessment of the vulnerability within 5 business days.
Fix notification
We notify you when the issue is fixed and credit you in our security acknowledgments (if desired).
Guidelines for researchers
Please DO:
- Test with a sample PDF you own (not production data)
- Provide clear reproduction steps and proof of concept
- Give us reasonable time to fix before public disclosure
- Manually verify findings from automated scanners
Please DO NOT:
- Access or modify other users' data
- Perform denial-of-service attacks or automated load testing
- Social-engineer our users or staff
- Submit unverified automated scanner output
Our attack surface
PrivacyScanPDF is architected to minimize attack surface. All PDF processing happens in the user's browser — there is no server-side file upload endpoint.
Server-side code (limited):
- • Static asset hosting (Vercel CDN)
- • Newsletter signup API (email address only, stored in Postgres)
- • Optional scan history API (opt-in, risk scores only — no file contents)
- • GA4 page-view analytics (IP anonymized, no ad personalization)
Client-side code (the main surface):
- • PDF parsing: pdf.js (Mozilla's library)
- • PDF manipulation: pdf-lib
- • PII detection: custom regex layer (50+ patterns)
- • All file processing runs in the browser tab — verifiable in DevTools
Bug bounty rewards
For higher-impact reports (server-side vulnerabilities, authentication bypass, cross-site scripting that could exfiltrate user data, etc.), we offer bug bounty rewards at our discretion. Reward amounts are based on severity and impact, typically ranging from $50 to $1,000.
Lower-impact reports (e.g., missing security headers, typos in security copy) are appreciated but may not qualify for monetary rewards. We will still credit you in our acknowledgments.
Security acknowledgments
We thank the following researchers for responsibly disclosing vulnerabilities (listed with permission):
No reports yet — be the first! Report a vulnerability to security@privacyscanpdf.com.