Report a vulnerability
GalaxyWarden handles personal identifiers for breach lookups. If you find a security issue, we want to hear from you before someone else does.
Contact
- Email: support@galaxywarden.com
- Machine-readable: /.well-known/security.txt (RFC 9116)
- Security reports: we acknowledge within 72 hours for initial triage. That is longer than our support reply target because triage means reproducing your finding, not just reading the mail — account and billing questions still get an answer within one business day, Mon–Fri, US Pacific.
Scope
In scope:
- galaxywarden.com and *.galaxywarden.com
- Authentication, session management, and account takeover vectors
- IDOR, SQL injection, XSS, SSRF, RCE
- Data exposure of breach-lookup results across users
- Payment/Stripe flow tampering
Out of scope:
- Findings from automated scanners without a working proof of concept
- Missing security headers on non-sensitive endpoints
- Self-XSS, clickjacking on pages without state-changing actions
- Rate-limit bypass on public marketing pages
- Social engineering of GalaxyWarden staff or users
Coordinated disclosure
- Please give us a reasonable window — 30 days for low and medium, 14 days for critical — before public disclosure.
- Do not access accounts or data that isn’t yours. Use a test account or your own account only.
- No brute-force, denial of service, or automated flooding against production.
- We will acknowledge your report, keep you updated on remediation, and credit you in the hall of fame below unless you prefer to stay anonymous.
Hall of fame
Researchers who have responsibly disclosed issues to us are listed here with their permission. The list is empty today — be the first.
Data handling
- Password checks never send your password — only a hash prefix.
- Breach lookups on your email go to Have I Been Pwned and DeHashed over TLS, and we do not log the query.
- The identifier you scan is kept for 48 hours so we can email you the result, then dropped, unless you are a subscriber to continuous monitoring.
- We do not sell, rent or license user data. See /privacy and /responsible-use.
Not here to report a bug?
See what’s already out there about you. The scan is free, takes about fifteen seconds, and needs no account and no card.
Free · no account · no card
Need help with your account rather than a security report? Help & FAQ · Contact support — we reply personally, within one business day, Mon–Fri, US Pacific.
Last updated April 2026. GalaxyWarden is operated by BATECH LLC.