Security at SweetCode
We take security reports seriously and thank everyone who reports issues responsibly.
Where to report
WordPress plugins
Each plugin has its own managed vulnerability disclosure program at Patchstack:
- Pixel Manager for WooCommerce: https://patchstack.com/database/vdp/woocommerce-google-adwords-conversion-tracking-tag
- Google Automated Discounts for WooCommerce: https://patchstack.com/database/vdp/gadwc
Valid reports receive a CVE and may qualify for rewards from the Patchstack Alliance under Patchstack's terms.
Website and infrastructure (sweetcode.com and its subdomains)
Email support@sweetcode.com with "Security" in the subject. Please include the affected URL, steps to reproduce, and the impact.
The website is not part of a bug bounty program. We do not pay for website reports, and we do not discuss rewards before or after a report.
What we ask
- Test only against your own accounts and data.
- No denial of service, load testing, spam, or social engineering of staff or customers.
- Do not access, change or keep data beyond what is needed to show the issue.
- Give us reasonable time to fix the issue before disclosing it publicly.
If you follow these rules in good faith, we will not take legal action against you.
Usually not accepted
- Missing or misconfigured SPF, DKIM or DMARC records
- Missing security headers without a working exploit
- Clickjacking on pages without sensitive actions
- Software version disclosure or banner grabbing
- Automated scanner output without a proof of concept
- Self-XSS, logout CSRF, or rate limiting on non-sensitive forms
- TLS configuration findings without practical impact
What to expect
We acknowledge reports within 5 business days and let you know when a valid issue is fixed.
