Working together for a safer internet
EarthShip is committed to working with security researchers across the globe to stay ahead of emerging threats. If you've discovered a security issue affecting our 200+ country forwarding network, we welcome the chance to work with you and fix it fast.
EarthShip serves 3,353+ customers who trust us to forward 78,545+ parcels a year from our free US tax-free suite address to 200+ countries — including buy-for-me purchasing, package consolidation, and live carrier rate shopping. Keeping that platform secure is core to how we operate. If you believe you've found a vulnerability in our web app, mobile app, or API, please let us know before disclosing it publicly, and we'll make every effort to quickly correct the issue.
Rules of engagement
While we want researchers to perform at their best, we also want to ensure minimal disruption to our business and our customers' shipments. As you research, please ensure the following:
- Submit one vulnerability per report, unless chaining vulnerabilities is required to demonstrate impact.
- When duplicates occur, we only credit the first report received, provided it can be fully reproduced.
- Multiple vulnerabilities caused by one underlying issue will be treated as a single report.
- Social engineering of any kind — phishing, vishing, smishing — against EarthShip staff or customers is strictly prohibited.
- Make a good-faith effort to avoid privacy violations, data destruction, and any interruption or degradation of our service. Only interact with accounts you own, or with the explicit permission of the account holder.
Testing rules
- Do not attempt to access private customer information, shipment records, or payment details belonging to others.
- Never attempt to view, modify, or damage data belonging to others — if you need to test a vulnerability, create your own free EarthShip account.
- Do not submit reports generated by automated scanners without first verifying a working proof-of-concept.
- Please include the IP address and timestamps you tested from in your report so our team can correlate logs.
Classification and rewards
Our rewards are based on a severity scale from P1 through P5. These are general guidelines only — final reward decisions remain at the discretion of EarthShip. As a scoring benchmark we reference the Bugcrowd Vulnerability Rating Taxonomy, though it is used only as a general guideline rather than a strict rulebook.
| Priority | Impact | Examples | Typical reward |
|---|---|---|---|
| P1 — Critical | Privilege escalation from unprivileged to admin, remote code execution, financial theft, or full account takeover. | Remote code execution · vertical authentication bypass · XXE with significant impact · SQL injection with significant impact | $2,000+ |
| P2 — High | Vulnerabilities that access sensitive data or affect infrastructure without full system compromise. | Horizontal authentication bypass · stored XSS · SSRF with limited impact | $800 – $2,000 |
| P3 — Medium | Vulnerabilities that affect multiple users and require little or no user interaction to trigger. | Reflected XSS · CSRF with meaningful impact · directory traversal | $250 – $800 |
| P4 — Low | Vulnerabilities that affect a single user and require significant interaction or unlikely conditions. | Clickjacking on low-impact pages · verbose error messages · missing security headers | $50 – $250 |
| P5 — Informational | Findings that do not directly demonstrate a security risk but are best-practice improvements. | Best-practice configuration issues · self-XSS · rate-limiting suggestions | Recognition only |
Out of scope
To keep reports actionable, the following are generally considered out of scope unless you can demonstrate real, meaningful impact: theoretical vulnerabilities without proof-of-concept, social engineering attacks, denial-of-service testing, physical attacks against EarthShip facilities or warehouses, and reports on out-of-date software versions without a working exploit.
How to submit a report
Send a clear, reproducible write-up — including affected URL or endpoint, steps to reproduce, impact, and any supporting screenshots or proof-of-concept code — through our contact page. Please allow our security team a reasonable time to investigate and remediate before any public disclosure. We aim to acknowledge every report within a few business days.
Last updated: July 2026.