Security: Responsible Disclosure

The security of DMarketplace matters to us. If you believe you have found a security vulnerability in our services, please report it to us as described on this page. It explains what is covered, how to test responsibly and how we handle reports. Last updated: October 2026.

Scope

This policy covers the following services of dMarketplace Inc.:

• our shops at dmarketplace.ai, dmarketplace.de and dmarketplace.co.uk
• our API at api.dmarketplace.ai
• the merchant panel at merchants.dmarketplace.ai
• our admin panel

Third-party services we use, such as the Request Network payment page, wallet apps or gift card issuers and their redemption websites, are not covered. Please report vulnerabilities in those services to the provider concerned.

Exclusions

The following are not security vulnerabilities under this policy:

• content errors, typos or outdated texts (please send them to our support as regular feedback)
• manipulation that only changes what your own browser shows, without any effect on our servers or on other users’ data
• rate-limit tests, load tests and denial-of-service tests
• social engineering (for example phishing) aimed at our team, merchants or customers
• output of automated scanners without a demonstrated, reproducible impact

Rules for testing

When you examine our services, please follow these rules:

• Use only accounts and data that belong to you. Do not access, change or delete other people’s data. If you come across someone else’s data by accident, stop, do not keep or share it, and mention it in your report.
• Do not disrupt our services or degrade them for others, for example through load tests, mass requests or spam.
• Go only as far as needed to demonstrate the issue, and do not exploit it any further, for example to obtain gift card codes or money.
• Keep your findings confidential until the issue has been fixed.

Safe harbor

If you act in good faith and within these rules, we consider your research authorized and will not take legal action against you because of it. If you are unsure whether something is allowed, ask us first at support@dmarketplace.ai.

This statement is made only by dMarketplace Inc. It cannot authorize tests of third-party services, and it does not cover actions that break these rules.

Rewards

We may reward reports of valid vulnerabilities at our discretion, depending on their severity and the quality of the report. There are no fixed amounts and no entitlement to a reward.

How to report

Send your report by email to support@dmarketplace.ai. Please include:

• the affected URL, page or API endpoint
• a description of the vulnerability and its possible impact
• the steps to reproduce it, for example requests, screenshots or a short video
• when you tested and which of your own accounts you used, if any

Please do not include other people’s personal data. We review every report and contact you by email if we need more information.

Our contact details for security reports are also available in machine-readable form at /.well-known/security.txt.