DirtyPhish services.
Reports may cover dirtyphish.com, www.dirtyphish.com and first-party site functionality. Third-party platforms linked from the site are governed by their own disclosure programmes.
REPORT IT.
HELP FIX IT.
If you believe you have found a security weakness affecting DirtyPhish, report it privately to security@dirtyphish.com. Please include the affected URL, impact, reproduction steps and any safe supporting evidence.
Minimise harm.
Use only accounts and data you own or have permission to test. Stop if you encounter personal data. Do not use denial of service, destructive testing, social engineering, credential attacks, spam or persistence.
Share enough to reproduce.
Send a clear description, affected location, steps, likely impact and remediation ideas. Do not publicly disclose the issue before there has been a reasonable opportunity to investigate and address it.
Good-faith handling.
DirtyPhish will acknowledge credible reports when practical and aims to keep reporters informed. This is not a paid bug-bounty programme and no reward is promised.