Vulnerability Disclosure & Bug Bounty

We welcome contributions from independent security researchers and ethical hackers. If you discover a security vulnerability in our platform, we commit to not taking legal action against you, provided that you conduct your research in good faith, avoid harming our users or systems, and follow the guidelines outlined below.

In-Scope: pdfconverterlab.com, api.pdfconverterlab.com, and our core conversion microservices. Out-of-Scope: Denial of Service (DoS/DDoS) attacks, social engineering of employees or contractors, physical attacks against our offices or data centers, and vulnerabilities resulting strictly from third-party client extensions.

Please submit full technical details, proof-of-concept scripts, and steps to reproduce directly to [email protected]. We encourage encrypting your communication using our published PGP public key. We will acknowledge receipt of your report within 24 business hours.

Critical Vulnerabilities (RCE, Authentication Bypass): Initial triage within 4 hours; patch deployed within 24 hours. High Severity (Privilege Escalation, SQLi): Triage within 12 hours; patch deployed within 72 hours. Medium/Low Severity: Triage within 48 hours; remediation in standard sprint cycle.