This page is for security researchers and customers who believe they have found a security problem in ads.txt Guru. It covers the service at adstxt.guru, its public API, the hosted ads.txt files we serve, and the ads.txt Guru Connect WordPress plugin.

How to report

Email security@adstxt.guru. The same contact is published in machine-readable form at /.well-known/security.txt. Please include:

• what you found and where: a URL, an API route, or the plugin file and line;
• the steps to reproduce it, or a proof of concept;
• what an attacker could do with it, as far as you can tell;
• how you would like to be credited, if at all.

Please do not put other people's data in a report. If reproducing the problem meant you could read data that is not yours, tell us that it did and stop there.

What we ask of you

• Test only against accounts and websites you own or are authorised to test. A free account is enough for almost everything.
• Do not run denial-of-service tests or automated scanners against the service, or anything else that degrades it for other users. The free validator is rate limited for exactly this reason.
• Do not access, change or delete other users' data, and do not keep any you come across by accident.
• Give us a reasonable time to fix the problem before you publish anything about it. We ask for 90 days from your report, and we will tell you sooner if the fix ships earlier.

Research done within these rules is welcome, and we will not take legal action over it. We do not run a bug bounty programme and cannot pay for reports, but we will credit you on this page if you would like us to.

What we do

• We acknowledge your report within three working days and tell you whether we can reproduce it.
• We fix confirmed problems in the service directly. There is nothing for you or our customers to install: adstxt.guru is a hosted service.
• We tell you when the fix is live.

The WordPress plugin

ads.txt Guru Connect runs on your own server, so a fix there is a new plugin release rather than a change on our side.

• Security fixes are published as their own release on wordpress.org, marked as a security release in the changelog and in the update notice WordPress shows you, and not bundled with feature changes. They are free of charge; the plugin has no paid version.
• Installing the update is the fix. WordPress can do that for you if you enable auto-updates for the plugin, which we recommend.
• We provide security fixes for the plugin for at least five years after each release, and for as long as it remains listed on wordpress.org.
• The plugin has no third-party components. It is a single PHP file that uses WordPress core functions only, so the only software it brings with it is itself; that is its complete bill of materials.
• If we learn that a vulnerability in the plugin is being actively exploited, we publish the fix, notify users through the plugin changelog and the WordPress update mechanism, and report it to the European Union's single reporting platform as the Cyber Resilience Act requires.

Out of scope

• Problems on customers' own websites, such as an ads.txt file that is wrong or missing. Those belong to the site owner, and our validator is the tool for finding them.
• Problems in services we use but do not run, such as our payment processor or our hosting provider. Please report those to them.
• Reports from automated scanners with no demonstrated impact, missing best-practice headers with no exploit behind them, and anything that needs physical access to a device.