Security

Report a vulnerability

To report a security problem in a HostLelo website, our billing panel or our own servers, write to our engineers through the contact page and say it is a security report. Include the address affected, the steps to reproduce it and what it exposes. Please do not access other people’s data.

Report it on the contact page

Reporting

What to send, and what not to do

  • Include

    • The address, host name or service affected
    • The steps to reproduce the problem
    • What it exposes or lets someone do
    • How to reach you for questions

  • Please don’t

    • Accessing, changing or deleting data that is not yours
    • Denial-of-service or load testing
    • Phishing or social engineering of our staff or customers
    • Publishing before we have had time to fix it

  • What this covers

    • www.hostlelo.com
    • panel.hostlelo.com (our billing panel)
    • HostLelo’s own servers and services
    A site or server a customer runs with us? Report abuse.

Our security.txt names the same contact, for tools that read it.

FAQ

Questions about reporting

No, that is abuse: report it on our abuse page, so it reaches the people who act on abuse.

Anything that harms someone else: accessing other people’s data, denial-of-service or load testing, and tricking our staff or customers. Stop and report as soon as you find a problem.

Yes, at /.well-known/security.txt, as RFC 9116 describes. It points to the contact page and to this page.

Report

Found something?

Tell our engineers on the contact page, and say it is a security report.

Go to the contact page