Security

Please report suspected security issues privately so they can be investigated before any public disclosure.

Report privately

Email coconutarmor.store@gmail.com with the affected URL or component, clear reproduction steps, expected impact and the smallest evidence needed to understand the issue. Do not include passwords, access tokens or personal data.

Current scope

• The public Coconut Armor Pages site and first-party API routes under coconut-armor.pages.dev.
• Third-party services such as Stripe, Cloudflare, Resend and fulfillment-provider platforms follow their own reporting programs.
• Checkout and live fulfillment are intentionally closed during prelaunch.

Responsible testing

• Use the minimum requests and data needed to demonstrate the issue.
• Do not access, retain, alter or disclose another person's data.
• Do not create payments, orders, subscriptions or provider jobs.
• Do not use denial-of-service, destructive testing, spam, social engineering or high-volume automated scanning.
• Stop testing and report privately if you encounter customer data or an active secret.

What to expect

Reports are reviewed according to operational capacity and risk. Coconut Armor does not currently operate a bug-bounty or reward program. Any disclosure timing must be coordinated with the authorized owner after containment and verification.

Legal boundary

This page provides a reporting route and testing constraints; it is not authorization to access systems or data beyond what applicable law and the relevant service owner permit.

Machine-readable reporting details are available at /.well-known/security.txt.