Report Security Issues

1. Scope

This policy covers security issues found on ovreal.shop and its checkout process. It does not cover third-party services we use (such as our payment processor or hosting provider) — please report issues with those services directly to the respective company.

2. What to Report

We’re especially interested in reports involving:

• Unauthorized access to customer or order data
• Payment or checkout vulnerabilities
• Cross-site scripting (XSS), SQL injection, or other injection vulnerabilities
• Authentication or account-access flaws
• Exposed sensitive files, credentials, or configuration data

3. What Not to Do

Please do not attempt any of the following while researching a potential issue:

• Accessing, modifying, or deleting customer or order data beyond what’s needed to demonstrate the issue
• Running automated scanners or load tests that could disrupt the Site for other users
• Attempting social engineering, phishing, or physical attacks against our team or facilities
• Publicly disclosing the issue before we’ve had a reasonable opportunity to address it

4. How to Report

Email Support@ovreal.shop with the subject line “Security Issue Report.” Please include:

• A clear description of the vulnerability
• Steps to reproduce it
• Any relevant screenshots, URLs, or request/response details
• The potential impact, as you understand it

5. What Happens Next

We aim to acknowledge security reports within 2 business days. We’ll investigate, keep you reasonably informed of our progress, and let you know once the issue has been resolved. We ask that you give us a reasonable amount of time to fix a confirmed issue before sharing it publicly.

6. Good-Faith Research

We will not pursue legal action against researchers who discover and report vulnerabilities in good faith, in accordance with this policy, and who avoid privacy violations, data destruction, or service disruption in the process.

7. Report a Security Issue