Security

Spot something that could put NinjaBuy or our customers at risk? Please tell us — we genuinely appreciate the help.

You do not need an account. Email security@ninjabuy.com, and your report will go straight to a person on our team.

What should I report?

• A security vulnerability in ninjabuy.com or a NinjaBuy API
• Customer or private data visible to the wrong person
• A leaked NinjaBuy API key, token, password, or other credential
• A way to take over an account or bypass sign-in or permissions
• A way to manipulate payments, orders, shipments, or account balances
• Anything else that could put our customers, data, money, or systems at risk

Not sure whether something belongs here? Send it anyway and we will point it in the right direction. For ordinary bugs, product questions, or feedback, you can also contact Support.

Help us understand it

Tell us what you found, where you found it, how we can reproduce it, and what could happen. Screenshots and short videos are welcome, but please remove secrets and personal data. Never send passwords, card details, or copied customer records.

We aim to reply within three business days, even if we are still investigating.

Please test carefully

1. Test only with accounts and data that belong to you or that you have permission to use.
2. Stop as soon as you have enough evidence to show us the problem.
3. Do not download, change, delete, keep, or share customer data.
4. Do not disrupt the service or affect other customers.
5. Keep the issue private until we fix it or agree with you on when to disclose it.

What we will do

We will acknowledge your report, investigate it, and keep you updated. We may offer a reward for a valid, original report. Rewards depend on the issue's impact and how clearly it is reported; duplicate reports are not eligible.

Safe harbor

If you act in good faith and follow these rules, we consider your research authorized and will not take legal action against you for it. Thank you for helping us keep NinjaBuy safe.

This promise covers only systems we own or control. It does not give you permission to test someone else's systems.