Security and vulnerability disclosure

Effective November 11, 2026

If you find a security problem on one of our websites, we want to hear about it. This page explains what you may test, how to report it and what we promise in return.

Report a problem

Email security@juliaprofitstudio.com. Please include the address of the page, what you found, the steps to reproduce it and what an attacker could do with it. English is preferred. Please do not include personal data you came across; describe it instead.

The same contact is published in our security.txt file.

What is in scope

juliaprofitstudio.com and its subdomains

Everything else is out of scope, in particular:

Websites we built for clients. They belong to our clients. Please report a problem there to the owner of that site.
The demo sites linked from our work page. You may tell us what you notice while browsing them normally, but we do not authorize testing them, because they are served from a shared hosting domain that we do not own.
The services we use, such as our hosting provider, our email service, our payment provider and Google. We cannot authorize testing of anyone else's systems. Please follow their own disclosure policies.

What is not allowed

Denial of service, or any test that slows a site down or floods a form or mailbox.
Social engineering, such as phishing, or pretending to be someone else, toward us or anyone else.
Any physical test of places or devices.
Accessing, changing, keeping or sharing data beyond what you need to show the problem. If you reach personal data, stop, tell us, and delete what you have.
Sending email to addresses that are not yours through our forms.

What we promise

We acknowledge your report within three business days (Monday to Friday, 9:00 AM to 6:00 PM Eastern Time).
We tell you what we found, keep you updated while we work on it, and tell you when it is fixed.
Please keep the problem private until we have fixed it, or told you that we will not, and give us a reasonable time to do so.
We do not pay bounties or rewards.

Good-faith research

If you make a good-faith effort to follow this policy while you research and report a problem, we consider your research authorized. We will work with you to understand and resolve the issue quickly, and we will not recommend or pursue legal action related to your research. If someone else takes legal action against you over activity that followed this policy, we will make it known that your research was authorized.

This covers our own domains listed above only. We cannot authorize testing of third-party systems, and this policy does not give you permission to test them.