1. Protect your account
Use an account you control, enable appropriate protections with your identity provider, and sign out on shared devices. Check the namedproof.com address before signing in or paying. We will not ask you to send a password, session cookie or full card number by email.
Protect copied research, downloaded cards and saved drafts as well as your login. A private workspace link is not permission to share another person's research. Tell us promptly if your account or an assignment credential may have been exposed.
2. Authorized assessment access
The agreed assessment scope must define permitted access and testing. Prefer least-privilege test accounts and synthetic or anonymized data. Do not conduct security testing of a company system without specific authorization from the party entitled to give it.
If you encounter unrelated personal information or a vulnerability outside scope, stop that activity, preserve only the minimum information needed to report it and notify the appropriate contact. Do not extract entire datasets to prove a finding.
3. Report a NamedProof security concern
Email [email protected] with “Security report” in the subject. Describe the affected URL or component, the suspected issue, minimal reproduction steps and potential impact. Redact personal data and tokens. Ask for a suitable channel before sending sensitive evidence.
Do not access other users' records, attempt credential attacks, cause denial of service, change or delete data, or demand payment to avoid disclosure. This page does not authorize intrusive testing, grant a legal safe harbor or establish a paid bug-bounty program.
4. Handling and limitations
We assess reports, may request clarification, and coordinate protective action and legally required notices when warranted. Please allow a reasonable opportunity to investigate before publishing sensitive details that could put users at risk.
No website is risk-free. We do not claim an independent security certification, uninterrupted service or guaranteed confidentiality in every circumstance. The privacy notice explains processing and your rights; this page does not replace incident-specific information.