Security Vulnerability Disclosure Policy

At OHPHAMMER, we take the security of our website, customer information and payment processes seriously. If you discover a suspected vulnerability affecting ohphammer.shop, please report it responsibly by e-mailing support@OHPHAMMER.shop with the subject line “Security report”. We review legitimate security concerns and aim to investigate and address verified issues according to their severity.

1. Responsible disclosure

We ask anyone reporting a potential vulnerability to act responsibly and comply with applicable law. Security reporters should:

• Avoid accessing or attempting to access other customers' accounts or private information.
• Avoid disrupting website operations, checkout services or payment processing.
• Never modify, delete, download or disclose information belonging to another person.
• Avoid exploiting a suspected weakness beyond what is necessary to describe it safely.
• Not perform denial-of-service testing, phishing or social engineering.
• Provide reasonable time for investigation before publicly disclosing an issue.
• Stop immediately if testing exposes sensitive information or creates a risk of damage.

Submission of a report does not authorise unlawful access or activity.

2. How to submit a security report

Send your report to support@OHPHAMMER.shop with the subject line Security report. Include:

• The affected website URL or feature.
• A clear description of the suspected vulnerability.
• When the issue was identified.
• Safe, reproducible steps.
• The potential security impact.
• Relevant screenshots that do not disclose private information.

Do not send passwords, full payment card numbers, authentication tokens or other customers' personal information.

3. Reviewing reports

Reports are assessed based on the potential impact, the information supplied and the ability to verify the issue safely. Critical concerns involving account security, payment safety or potential customer data exposure receive appropriate priority. We aim to respond to enquiries within 1 working day, although a complete security investigation may take longer.

4. Security rewards

OHPHAMMER does not currently advertise a paid bug-bounty or vulnerability reward programme. Reporting a security issue does not create an entitlement to compensation. Any future programme will be announced separately with clear eligibility requirements.

5. Non-qualifying and out-of-scope reports

The following reports may not require corrective action unless a meaningful security impact is demonstrated:

• Missing security headers without a demonstrated risk.
• Scanner reports without supporting evidence.
• Issues affecting only unsupported browsers.
• Theoretical attacks without a reproducible vulnerability.
• Third-party infrastructure outside the store's control.
• Duplicate issues previously reported.
• Attempts involving social engineering, account intrusion or disruptive testing.

6. Suspicious messages

If you receive a suspicious e-mail requesting payment details, passwords or unusual order verification, do not provide the information. Contact OHPHAMMER directly through the published support e-mail or telephone number.