Responsible disclosure

Scope

This policy covers security issues affecting:

• The website at thebytelite.com, including every page it serves.
• The contact form and the server function behind it.
• The checkout and billing endpoints of this website, which are currently switched off.

Private software, research systems and non-public infrastructure are outside the scope of public testing unless ByteLite LLC authorizes it in writing.

Do not test payment flows with real card details. Describe a suspected payment issue and it will be reproduced in a test environment.

How to report

Email security@thebytelite.com, or use the contact form. Include a description of the issue, steps to reproduce it, its likely impact and how to reach you.

What to expect

• A reasonable effort to acknowledge valid reports and keep you informed.
• An explanation of what was found, including when an issue is judged not exploitable.
• Credit when the issue is resolved, if you want it.

ByteLite LLC is a founder-led company with no security team on call, so there is no guaranteed response time. A real vulnerability in a live path is handled ahead of other work.

Please do not

• Access or change data that is not yours.
• Take any action that could harm the service or its users, including denial-of-service testing.
• Disclose the issue publicly before it has been addressed.

Good-faith research

ByteLite LLC will not pursue legal action against researchers who follow this policy, act in good faith and cause no harm.