Report Security Issues

If you’ve found a security vulnerability on Blomzi.com, we encourage you to contact us immediately. We review all legitimate reports and aim to resolve issues quickly. Before reporting, please review this document, including our fundamentals, bounty program, reward guidelines, and non-reportable issues.

Scope

This policy applies to the Blomzi.com website operated by Blomzi LLC. Payments on our store are processed by Stripe, and some features rely on third-party services and software, such as WordPress, WooCommerce, and their plugins. Please do not test the systems of these third parties. Vulnerabilities in their products should be reported directly to the respective vendor.

Fundamentals

If you follow the principles below when reporting a security issue to Blomzi.com, we will not initiate legal action or enforcement investigations against you in response to your report.

We ask that:

  1. You give us reasonable time to review and fix the issue before disclosing it publicly or sharing it with others.
  2. You do not interact with or access private accounts without the account owner’s consent.
  3. You make a good-faith effort to avoid privacy violations, service disruptions, or data destruction.
  4. You do not exploit the issue for any reason, including to demonstrate further risks or access sensitive data.
  5. You do not test with real payment card details or attempt to access customer payment information.
  6. You comply with all applicable laws and regulations.

Bounty Program

We recognize and reward security researchers who help protect our store by reporting vulnerabilities. Bounties are awarded at Blomzi LLC’s discretion, based on risk, impact, and report quality.

To potentially qualify for a bounty, you must:

  1. Follow the fundamentals listed above.
  2. Report a valid security bug that poses a risk to privacy or security.
  3. Submit your report by email to Support@blomzi.com with the subject line “Security Report.” Please do not contact employees directly or through social media.
  4. Disclose any accidental privacy violations or disruptions in your report.
  5. Understand that while we investigate all valid reports, priority is based on risk, and a response may take some time.
  6. Agree that we reserve the right to publish submitted reports.

Rewards

Rewards are based on the impact and severity of the vulnerability. Please provide detailed and reproducible steps in your report. If the issue cannot be reproduced, it is not eligible for a bounty.

  1. The first valid report of an issue receives the bounty.
  2. Multiple bugs caused by a single underlying issue are treated as one report.
  3. We assess rewards based on impact, exploitability, and report quality.
  4. The following are our current maximum reward amounts by severity:

Critical Severity – Up to $200

Includes major issues like:

  • Remote Code Execution
  • Remote Shell or Command Execution
  • Vertical Authentication Bypass
  • SQL Injection that leaks targeted data
  • Full account access

High Severity – Up to $100

Includes issues such as:

  • Lateral authentication bypass
  • Disclosure of sensitive internal data
  • Stored XSS affecting other users
  • Local file inclusion
  • Insecure handling of authentication cookies

Medium Severity – Up to $50

Examples include:

  • Logic or business process flaws
  • Insecure object references

Low Severity – Recognition Only

Examples include:

  • Open redirects
  • Reflected XSS
  • Low-sensitivity information leaks

Non-Reportable Issues

The following are generally not eligible for a bounty or recognition:

  • Denial-of-service (DoS) attacks, brute-force attacks, or spam
  • Social engineering, phishing, or physical attacks against our staff, customers, or premises
  • Vulnerabilities in third-party services, plugins, or platforms (including Stripe, Google, WordPress, and WooCommerce) that are not caused by our configuration
  • Missing security headers, cookie flags, or email configuration records (SPF, DKIM, DMARC) without a demonstrated security impact
  • Clickjacking on pages with no sensitive actions
  • Reports from automated scanners without a working proof of concept
  • Issues that require a rooted or jailbroken device, or outdated and unsupported browsers

Contact Information

Blomzi LLC
Address: 4312 Rd 111, Pasco, WA 99301, USA
Phone: +1 509 616 7509
Email: Support@blomzi.com