Security

Found a security weakness in sizbo.com? Please report it to us privately and allow us time to fix it before anyone else hears about it. Last updated 23 October 2026.

Scope

This covers sizbo.com and the pages we publish on it. Send your report to info@sizbo.com with “Security report” as the subject. We aim to confirm we have it within 5 business days. If you research in good faith and keep to the rules below, without harming visitors or the service, we will not treat it as unauthorized access.

Reports we want

• Anything that lets someone run a script, inject a query, or get at data that should be off limits.
• Problems with sessions, or with who is allowed to see an order page or a design.
• Server settings that reveal information that should be private.

Not covered here

• Flooding the site or stress-testing the live service.
• Phishing, social engineering, or trying to get in physically.
• Issues that belong to a payment company, a hosting provider, or an email service.
• A missing header, unless you show how it can be exploited.
• Copyright questions about a design: please use the contact page.
• Orders and refunds: please see the returns page.

Testing rules

• Do not view, change or delete data that belongs to someone else.
• Do not place real orders or use someone else's order details unless we have agreed to it in writing.
• Stop as soon as you can show the problem, and keep each test as small as possible.
• Keep the details to yourself until we have had a reasonable time to fix it, usually 90 days.
• Do not collect personal data from the site.

In your email, tell us what an attacker could do, how to reproduce it, and how to reach you. We do not pay bounties, but with your permission we may thank you publicly once it is fixed. Researchers can also find our contact file at /.well-known/security.txt.