Found a problem? Tell us.

How to report

Please include enough detail for us to reproduce the issue: the URL or endpoint affected, the steps you took, and what you saw. A short proof of concept is worth more than a scanner report. If you are not sure whether something counts, send it anyway — a false alarm costs us five minutes and a missed report costs a great deal more.

A machine-readable version of this policy is published at /.well-known/security.txt, in accordance with RFC 9116.

Our commitment to you

If you act in good faith and follow the rules on this page, TryStamped will not pursue legal action against you, will not report you to law enforcement, and will not ask your internet provider or employer to take action against you. We consider research conducted under this policy to be authorised.

We will keep you informed of progress, tell you when the issue is fixed, and credit you publicly if you would like that. We will not ask you to sign anything or to stay silent indefinitely as a condition of being taken seriously.

TryStamped does not currently operate a paid bug bounty. We would rather say that plainly than leave it vague — there is no reward beyond our thanks and, if you want it, public credit.

What is in scope

• trystamped.app and www.trystamped.app
• The search and health API routes served from those domains
• The DNS, mail, and TLS configuration of trystamped.app
• The supporter page — specifically anything that could misdirect a contribution, misrepresent an amount, or send someone to a checkout that is not ours

What is out of scope

TryStamped is a comparison layer. When you follow a link from here, you land on a retailer, marketplace, or payment provider we do not operate. Please report issues on those services to those companies, not to us — we cannot fix them and we cannot grant you permission to test them.

• eBay, Best Buy, and any other retailer, marketplace, or affiliate network
• Stripe, which hosts our checkout pages and has its own disclosure programme. Please do not test payment flows by making real contributions.
• Cloudflare, our hosting and DNS provider, which also runs its own programme
• Volumetric denial of service, load testing, or anything that degrades the service for other people
• Social engineering of anyone connected to TryStamped, and physical attacks of any kind
• Reports produced solely by an automated scanner, with no demonstrated impact
• Missing best-practice headers or configuration flags with no exploitable consequence

Rules of engagement

Test only against your own activity. Do not access, modify, or store data that is not yours, and stop as soon as you have confirmed a vulnerability exists — you do not need to prove how far it goes. Do not degrade the service for other users, and give us a reasonable opportunity to fix an issue before discussing it publicly.

What TryStamped actually holds

Worth knowing before you go looking, because it shapes what is realistically at risk here.

TryStamped has no user accounts, no sign-up, no passwords, and no app. Searching is free and anonymous. Search terms are counted so we can see which products people want and which searches come up empty, but that count carries no IP address, no cookie and no visitor id — there is nothing in it that could tie one search to another, so no profile of you exists or can be built from it. TryStamped is not the seller of any item shown and is never the merchant of record on a purchase you make from a retailer, so it never sees your card details on a shopping transaction.

Voluntary contributions are the one exception, and they are handled entirely by Stripe. The supporter page holds no payment form and collects nothing — every button is a link to a checkout page hosted by Stripe on Stripe's own domain. Your card number is entered on Stripe's page, is processed by Stripe, and is never transmitted to or stored by TryStamped. What TryStamped can see afterwards is what any Stripe account holder sees about their own customers: your name, your email address, the amount, and the last four digits of the card. Supporting TryStamped is optional, buys no influence over any result, and the site works identically whether you do or not.

The practical consequence is that there is no password database and no card data here to breach. That is a deliberate design choice rather than an accident, and it is one we intend to keep. Our full Privacy Policy is the binding statement of what we collect.

Reporting impersonation

If you receive an email claiming to be from TryStamped that you believe is fraudulent, or find a site impersonating TryStamped, send it to hello@trystamped.app.

Two things worth knowing. TryStamped will never email you asking for a password or a card number — there is nothing on this site you are required to pay for. And every legitimate contribution checkout happens on a stripe.com address that you can see in your browser's address bar; a payment page on any other domain claiming to be TryStamped is not us, and we would like to hear about it.

Mail from TryStamped comes from trystamped.app. Note the "try". Anything from a similar-looking domain is not us.

Thanks

Researchers who have reported issues to us, with their permission, will be listed here.

TryStamped is a small operation. Reports are read by a person, not a queue, and are taken seriously.