Report Security Issues

SECURITY & VULNERABILITY DISCLOSURE POLICY

Last updated: August 19, 2026

At The Party Empire, we take the security of our website and our customers seriously.

If you believe you have discovered a security vulnerability affecting thepartyempire.shop

we encourage you to report it to us responsibly.

We will review legitimate security reports and make reasonable efforts to investigate and address confirmed vulnerabilities as quickly as possible.

Before submitting a report, please review the guidelines below.

1. RESPONSIBLE DISCLOSURE GUIDELINES

When investigating or reporting a potential security vulnerability, we ask that you:

  1. Give us a reasonable amount of time to investigate and resolve the reported vulnerability before publicly disclosing it or sharing details with third parties.

  2. Do not access, modify, delete or otherwise interact with another person's account or data without the account owner's explicit permission.

  3. Make a good-faith effort to avoid privacy violations, loss of data, disruption of our services or any negative impact on other users.

  4. Do not exploit a vulnerability beyond what is reasonably necessary to demonstrate that the vulnerability exists.

  5. Do not attempt to access sensitive customer, employee or company information beyond what is necessary to demonstrate the issue.

  6. Do not perform actions that could damage, interrupt or degrade our website, infrastructure or third-party services.

  7. Do not use social engineering, phishing, physical attacks or threats against our customers, employees, contractors or service providers.

  8. Comply with all applicable laws and regulations.

Where you act in good faith and comply with this policy, The Party Empire will not intentionally initiate legal action against you solely for your responsible security research and report, subject to applicable law and the rights of third parties.

2. REPORTING A VULNERABILITY

If you discover a potential security vulnerability, please provide as much relevant information as possible, including:

  • A clear description of the vulnerability;

  • The affected page, URL or functionality;

  • Steps required to reproduce the issue;

  • The potential security impact;

  • Screenshots or supporting evidence where appropriate;

  • Any suggested remediation, if available.

Please do not include unnecessary personal information or customer data in your report.

If you unintentionally access confidential information, personal data or restricted systems while investigating a vulnerability, stop testing and inform us in your report.

3. ELIGIBLE SECURITY ISSUES

Examples of vulnerabilities that may be considered valid include:

  • Remote code execution;

  • Authentication or authorisation bypass;

  • SQL injection;

  • Cross-site scripting (XSS);

  • Insecure direct object references (IDOR);

  • Significant exposure of sensitive information;

  • Privilege escalation;

  • Local file inclusion;

  • Serious authentication or session-management vulnerabilities; and

  • Other vulnerabilities that create a demonstrable security or privacy risk.

The presence of a technical bug does not automatically mean that it constitutes a security vulnerability.

4. OUT-OF-SCOPE REPORTS

The following issues will generally not be considered security vulnerabilities unless they demonstrate a significant security impact:

  • Missing security headers without demonstrated impact;

  • Self-XSS;

  • Clickjacking without meaningful security impact;

  • Open redirects without additional security impact;

  • Rate-limiting issues without demonstrated risk;

  • Automated scanner reports without verification;

  • Issues affecting outdated or unsupported browsers;

  • Social engineering attempts;

  • Denial-of-service (DoS/DDoS) testing;

  • Physical security attacks; and

  • Reports based solely on theoretical vulnerabilities without reproducible evidence.

Please do not perform testing that could disrupt our website or services.

5. SECURITY RESEARCH

Security testing should only be conducted to the minimum extent necessary to identify and demonstrate a vulnerability.

You must not:

  • Download or retain customer data;

  • Modify or delete data belonging to another person;

  • Attempt to gain persistent access to our systems;

  • Install malware or malicious software;

  • Conduct denial-of-service attacks;

  • Conduct phishing or social engineering;

  • Attempt to compromise employees, customers or third-party providers; or

  • Use a vulnerability for financial gain, fraud or any other malicious purpose.

If sensitive information is unintentionally accessed, stop testing immediately and report the incident to us.

6. REPORT REVIEW

We aim to review legitimate vulnerability reports and prioritise them according to factors such as:

  • Potential impact;

  • Severity;

  • Exploitability;

  • Number of users potentially affected; and

  • Risk to customer or company information.

Response and resolution times may vary depending on the complexity and severity of the reported issue.

Submission of a report does not guarantee that an issue will be classified as a security vulnerability.

7. BUG BOUNTY & REWARDS

Any monetary reward offered by The Party Empire is entirely discretionary unless we have expressly agreed otherwise in writing.

Where we choose to provide a reward, factors that may be considered include:

  • Severity and impact;

  • Exploitability;

  • Quality and completeness of the report;

  • Reproducibility;

  • Whether the vulnerability was previously known or reported; and

  • Assistance provided during investigation and remediation.

For duplicate reports, priority will generally be given to the first complete and reproducible report we receive.

Multiple vulnerabilities resulting from the same underlying security issue may be treated as a single report.

Submitting a vulnerability report does not guarantee payment or any other reward.

8. SEVERITY GUIDELINES

Critical Severity

Examples may include:

  • Remote code execution;

  • Remote command or shell execution;

  • Critical privilege escalation;

  • Authentication bypass resulting in administrative access;

  • SQL injection exposing highly sensitive information;

  • Vulnerabilities enabling significant financial theft; or

  • Full unauthorised access to customer accounts.

High Severity

Examples may include:

  • Significant authentication bypass;

  • Significant exposure of confidential information;

  • Stored XSS affecting other users;

  • Local file inclusion;

  • Serious session-management vulnerabilities; or

  • Insecure handling of authentication credentials or cookies.

Medium Severity

Examples may include:

  • Significant business logic vulnerabilities;

  • Insecure direct object references (IDOR);

  • Security issues affecting multiple users with limited interaction required; or

  • Other vulnerabilities with a moderate demonstrable security impact.

Low Severity

Examples may include:

  • Open redirects;

  • Reflected XSS with limited impact;

  • Low-sensitivity information disclosure; or

  • Vulnerabilities requiring significant user interaction or unusual prerequisites.

Final severity classifications are determined by The Party Empire based on the circumstances and demonstrated impact of each vulnerability.

9. PUBLIC DISCLOSURE

Please do not publicly disclose a vulnerability before we have had a reasonable opportunity to investigate and address it.

We may request additional information from you during our investigation.

The Party Empire reserves the right to publish information about resolved vulnerability reports where appropriate, while taking reasonable steps to protect confidential and personal information.

10. CONTACT

To report a security vulnerability affecting thepartyempire.shop, please contact:

The Party Empire

Email: contact@thepartyempire.shop

Please include “Security Vulnerability Report” in the subject line and provide detailed, reproducible steps wherever possible.