Vulnerability Disclosure Policy

Last updated: October 14, 2026

Reporting a security problem

If you think you have found a security problem in SettleQuik, we want to hear about it. This policy explains what to report, how to report it, and the limited research SettleQuik authorizes.

What is in scope

The following SettleQuik-owned and operated application services are in scope: (1) settlequik.com, including the creator console and the admin console; (2) creator pages at settlequik.com/[username] and [username].settlequik.com; and (3) SettleQuik’s own API at settlequik.com/api.

A creator’s words, images, links, or other content are not themselves security vulnerabilities; use “Report this page” for those concerns. A technical flaw in the way SettleQuik renders or serves a creator page—for example, a cross-site-scripting vulnerability—may be in scope if you test only as this policy permits.

What is out of scope

Out of scope are systems, infrastructure, accounts, applications, or data operated by another company, including Dodo Payments; hosting and network providers; the email provider; and creator-selected payment, contact, social, messaging, or store services. Report vulnerabilities in those services to the company that runs them. A SettleQuik application vulnerability remains in scope even if hosted by a third party; the third party’s infrastructure is not authorized for testing.

Also out of scope are creator content (as distinct from a SettleQuik rendering/serving flaw); DoS/DDoS or any test that disrupts or slows the service; social engineering, phishing, physical attacks, or contact with staff, creators, or customers to obtain access or information; spam; and reports that list only missing headers/settings without a reproducible security impact.

How to report

Email [email protected] with the affected page/API route, reproduction steps, and what an attacker could do. Do not include another person’s personal information. If you encounter it, identify only its type, stop testing, and do not include the information itself.

We aim to acknowledge reports within 5 Business Days. For this policy only, a Business Day is Monday through Friday, excluding U.S. federal holidays. This acknowledgement aim is not a service-level agreement and does not amend any support or SLA term. We may ask for additional detail. When reasonably practicable, we will let you know whether we fixed the reported issue or decided that no further action is planned.

We do not pay rewards for reports.

Limited research authorization

Use only an account you own or a test account you create. An admin console being in scope does not authorize access to an administrator account you do not own or have not been expressly authorized to use.

Limit testing to what is reasonably necessary to identify and confirm the vulnerability, then stop. Do not access another person's account or nonpublic data without permission, alter another person's page or data, copy or retain another person's nonpublic information, establish persistence, escalate into an account or privilege you are not authorized to use, move laterally, introduce malware, bypass rate limits, evade rate limits by spreading requests, run load-producing scans or tests, or disrupt service. Ordinary viewing of a public creator page does not authorize exploiting it or using another person's private information.

If you inadvertently encounter third-party or another person’s data, stop immediately. Do not access further, copy, retain, use, change, or disclose it. Report only the data type and the minimum details needed to describe the vulnerability.

Please contact us before public disclosure and work with us on a reasonable coordinated-disclosure timeline. Reporting a vulnerability or communicating with us does not authorize additional testing, broader access, or continued access.

Our commitment to good-faith researchers

If you follow this policy, SettleQuik will treat your compliant research as authorized by SettleQuik for the limited purpose described here. To the extent permitted by applicable law and within SettleQuik’s authority, SettleQuik will not initiate a civil legal action against you based solely on research that complies with this policy.

To the extent permitted by applicable law, SettleQuik will not voluntarily refer you to law enforcement based solely on compliant research. This does not prevent SettleQuik from preserving information, complying with a legal obligation or valid preservation/disclosure request, or making a report that it reasonably believes is necessary to address a credible threat to safety.

This commitment applies only to SettleQuik and only to activity this policy covers. It does not authorize third-party testing, bind any third party or government authority, create immunity from civil or criminal liability, or make unlawful conduct lawful. It does not apply to conduct that harms customers, exceeds this policy, or otherwise violates applicable law.

If unsure whether an activity is allowed, email [email protected] before testing.

Policy owner: SettleQuik LLC, through its designated security contact at [email protected]. Review cadence: At least every six months and after a material change in scope or reporting practice.