Security & vulnerability disclosure
Last updated 20 September 2026
If you find a security problem here, we want to hear about it, and we will not treat a good-faith report as an attack.
How to report
Email hello@ratedcreators.com with the subject “Security”. Include enough to reproduce the issue. This address is also published at /.well-known/security.txt.
What we ask
- Do not access, alter or download data that is not yours; a proof of concept on your own account is enough.
- Do not run denial-of-service tests or automated scanners against the site.
- Give us a reasonable time to fix before publishing.
What we commit to
- An acknowledgement within two working days and a fix timeline once the issue is confirmed.
- No legal action against good-faith research that follows the above.
- Credit, if you want it, once the fix is live.
What we do on our side
No passwords are stored for anyone: creators, agencies and readers sign in with single-use links, and only hashes of tokens and sessions are kept. Raw IP addresses are never stored. Payment card data never touches this site. Every public write endpoint is rate-limited in the database; the anonymous page-view counter is rate-limited per instance and records nothing identifiable. The moderation log is append-only.