Last updated: August 6, 2026
Responsible Disclosure
If you believe you have found a security vulnerability, please report it through our Contact Us page and include "Security Report" in your message. Please provide enough information for us to validate the issue without requiring intrusive testing or access to data that does not belong to you.
What to Include
- Affected URL, endpoint, account area, or subdomain.
- Clear reproduction steps with minimal proof of concept details.
- Observed impact and any security boundary that may be affected.
- Screenshots, request IDs, timestamps, logs, or sanitized examples when useful.
- Your name or organization and a reliable way for us to contact you.
Allowed Testing
- Manual, non-destructive validation against publicly accessible IPLocation.net pages and services.
- Low-rate testing that stops as soon as the issue is confirmed.
- Testing only with accounts, API keys, data, and systems you own or are authorized to use.
- Reports that give us enough detail to reproduce the issue without exposing other users.
Prohibited Activity
Do not perform denial-of-service testing, destructive testing, privacy-invasive testing, or any activity that could disrupt IPLocation.net or other users.
- Denial-of-service, stress testing, high-volume scanning, or resource exhaustion.
- Accessing, changing, deleting, or exfiltrating data that does not belong to you.
- Credential attacks, password spraying, phishing, social engineering, spam, or physical attacks.
- Installing malware, opening reverse shells, persistence, pivoting, or attempting to bypass monitoring.
- Public disclosure before we have reviewed and addressed the report or given written permission.
Review and Response
We review reports at our discretion and prioritize issues based on reproducibility, exploitability, user impact, and operational risk. We do not guarantee a response timeline for unsolicited reports, but clear and well-scoped reports are easier for us to review.
- We prioritize reports that are reproducible, specific, and show realistic security impact.
- We may close duplicates, scanner-only output, theoretical issues, missing security headers without impact, and reports about third-party services outside our control.
- Submitting a report does not create a consulting relationship, employment relationship, or payment obligation.
Rewards and Compensation
IPLocation.net does not currently operate a paid bug bounty program. We do not promise rewards, retroactive payments, or compensation for unsolicited vulnerability reports, security scans, audit summaries, or follow-up requests.
Safe Harbor
If you act in good faith, follow this policy, avoid privacy violations, avoid service disruption, and report issues promptly, we do not intend to pursue legal action solely because of your responsible disclosure. This statement does not authorize prohibited testing or activity that violates applicable law.