Report a security issue
Last updated: 1 November 2026. OnlyBills stores the email addresses of people on its waitlist; this page explains how to report a security issue that could affect that data or the site.
How to report
Email [email protected] (or [email protected] if that bounces) with the affected URL, the steps to reproduce and what an attacker could do with it. Please keep the details private until we have fixed the issue. Machine-readable contact details are in security.txt.
What we promise
- We confirm your report within 3 working days and keep you posted until it is fixed.
- We fix critical issues as fast as we can, usually within 48 hours of confirming them.
- If you want, we credit you once the fix is live.
- We won’t take legal action against good-faith research that follows the rules below.
Rules for testing
- Only test against your own data. Don’t access, change or delete anyone else’s.
- No denial-of-service, load testing or automated scans that flood the site or the waitlist.
- No social engineering, phishing or physical attacks.
Out of scope
- Services we use but don’t run, such as Cloudflare and Google Analytics. Report those to the vendor.
- Scanner output without a demonstrated impact, such as a “missing header” report.
- The published content of the site (billers, bills, comments): it is editorial, not user-generated.
There is no paid bug bounty yet.