WebPingSecurity
Hall of Fame
Responsible Disclosure
Found a security issue in WebPing? Report it and we will fix it first. We do not pay bounties — we credit researchers publicly in our Hall of Fame.
How to report
Email security@webpeaker.com with:
- Clear description of the vulnerability
- Steps to reproduce (proof of concept welcome)
- Affected URL / endpoint and parameter
- Your impact assessment
We acknowledge every report within 48 hours and keep you updated until the fix ships.
What we offer
No monetary bounties. Instead, confirmed and responsibly disclosed issues earn a permanent entry in the WebPing Hall of Fame on this page — with your name, handle, and the date credited as you wish.
Recognition is our currency. You choose the exact name or alias to publish.
Scope
In scope
webping.webpeaker.comand its subdomains- Web application and API endpoints
- Authentication, authorization & session handling
- Webhook signature verification
- SQL injection, XSS, CSRF, SSRF, IDOR
Out of scope
- DoS / brute-force / spam / social engineering
- Missing security headers without demonstrated impact
- Self-XSS or issues requiring your own account
- Rate limiting or timing attacks on public endpoints
- Physical or network-level attacks on infrastructure
Safe harbor
We will not pursue legal action against anyone who discovers and reports vulnerabilities in good faith: use no more access than needed to demonstrate the issue, avoid affecting customer data and privacy, give us reasonable time to fix before public disclosure, and never exploit what you find.
Recognition
Hall of Fame
Researchers whose reports made WebPing safer.
Describe it, reproduce it, and mail us the details.