1. Report a suspected issue
If you believe you found a security vulnerability in stencll.com or a website operated by Stencll, use the contact form and include "Security report" in the message. Include the affected URL, a clear description, steps to reproduce, potential impact, timestamps, and screenshots or logs that do not contain secrets or personal information.
2. Responsible testing
Do not access, alter, download, or disclose data that does not belong to you. Do not perform denial-of-service testing, social engineering, spam, credential attacks, automated high-volume scanning, or tests against third-party systems. Stop testing and contact us if you encounter personal or confidential information.
3. Our response
We will make a reasonable effort to acknowledge a report, investigate its validity and impact, and take appropriate corrective action. Response and remediation times depend on severity, exploitability, affected providers, and available information. We may share a report with hosting or service providers when necessary to investigate or remediate.
4. Client websites and third parties
Stencll may build or maintain websites that use client-controlled hosting, accounts, plugins, APIs, and infrastructure. For those sites, report the issue to the site owner or its hosting provider as well as Stencll where appropriate. Stencll cannot control vulnerabilities introduced by client changes, unsupported dependencies, third parties, compromised credentials, or infrastructure outside our administration.
5. No guarantee
This page describes a reporting process, not a warranty or guarantee that any site is secure. Security is a shared responsibility and can never be guaranteed absolutely. The Terms and Conditions govern liability and other legal matters.