Security policy

Last updated: 5 November 2026

We take the security of validateemail.io and our customers' data seriously. If you think you've found a vulnerability, we want to hear from you.

How to report a vulnerability

Email security@validateemail.io with:

• a description of the issue and where it is (URL or API endpoint)
• the steps to reproduce it, and any proof-of-concept
• the impact you think it has
• how you'd like to be credited, if at all

We'll acknowledge your report, keep you updated while we investigate, and tell you when it's fixed. Please give us a reasonable amount of time to fix the issue before you disclose it publicly.

Scope

In scope: the validateemail.io website, the /v1 API, the sign-up and account endpoints, and the embeddable widget.

Out of scope:

• denial-of-service or load testing, and anything that degrades the Service for others
• spam, social engineering or phishing, and physical attacks
• vulnerabilities in third-party services we use, which you should report to them
• findings with no real security impact, such as missing best-practice headers on non-sensitive pages, or self-XSS

Safe harbour

If you act in good faith and follow this policy, we won't take legal action against you or ask anyone else to, for research that:

• uses only accounts and API keys you own, or test data
• avoids accessing, changing or deleting other people's data. If you encounter personal data, stop, report it, and don't keep it.
• avoids degrading the Service or bypassing quotas at scale
• keeps the details confidential until we've fixed the issue

We don't currently run a paid bug bounty.

Machine-readable contact

Our contact details are also published in security.txt, following RFC 9116.