Security

Email security@paidamplification.com. Tell us what you found and how to reproduce it. We will acknowledge within two working days.

We will not threaten you, and we will credit you if you want the credit. There is no bug bounty because there is no revenue yet, and we would rather say that than imply a payment that is not coming.

If somebody compromises our content delivery and swaps the tracking script, every customer site serving it starts running attacker code against their own visitors. That is the Polyfill.io and Magecart failure mode, and it is the risk that shapes every decision below.

Every release is pinned to an exact version and published with a SHA-384 hash. You install it with a subresource integrity attribute, which means the browser verifies the file against that hash before executing it. A swapped file does not run. It fails closed.

The trade-off is real and worth stating: a pinned script does not receive fixes until you update the tag. You can use a rolling URL without the integrity attribute instead, and you would be trading that protection for convenience.

The browser bundle contains our code and nothing else. Not few dependencies, zero. Every dependency in a browser bundle is somebody else's compromise becoming your visitors' compromise, and the campaigns that reached tens of thousands of repositories in recent years got there through maintainers who did nothing wrong.

This is enforced in continuous integration rather than by convention. The build fails if the tracker package declares a dependency or if any tracker source file imports one.

A size budget. The core script is held under a hard limit, and added weight is treated as a security regression rather than a performance one, because more code is more surface.

An abstract syntax tree ban. Automated checks reject the use of eval, innerHTML and dynamic script injection anywhere in the tracker. These are the primitives that turn a small bug into remote code execution.

A credential scan. The build fails if anything resembling a key is committed.

A dependency audit. High and critical advisories fail the build, and package lifecycle scripts are disabled during installation, since a postinstall hook runs with full environment access before any of our own code executes.

A cross-tenant isolation test. This one runs against a real database with row-level security enabled, and it fails the build both when isolation breaks and when the test skips. A skipped security test looks exactly like a passing one on a summary page, which is how this class of failure survives.

A separate process fetches the published script from outside our own infrastructure and verifies it against the expected hash. It checks from more than one region and more than one user agent, including mobile.

The mobile part is not incidental. The Polyfill.io payload served malicious code only to mobile devices, which meant administrators loading the script in a desktop browser saw nothing wrong. Checking from your own laptop is the check that fails.

No SOC 2 report, no ISO 27001 certificate, no penetration test by a third party. The product is pre-revenue and those cost real money. When they exist this page will say so with dates.

The sub-processor list is published. The data processing agreement is drafted and not yet available for signature, because the hosting regions it would commit to are not finalised.

If you are evaluating this for a business that needs those documents today, the honest answer is that we are not ready for you yet.