Why Responsible Disclosure Matters

Pinocchio Collectibles values the security research community and welcomes responsible disclosure of potential vulnerabilities. Reporting privately allows us to investigate, fix, and protect our customers before information is shared publicly.

What You Can Report

• Authentication or session vulnerabilities
• Cross-site scripting (XSS)
• Cross-site request forgery (CSRF)
• Injection vulnerabilities
• Insecure data exposure
• Access control issues
• Suspicious or fraudulent activity on CardCorner.shop

What Not to Report

• Missing HTTP security headers without demonstrable impact
• Automated scan output without proof-of-concept
• Reports based on outdated software versions with no exploit
• Social engineering, phishing, or physical access attempts

How to Report

Please send your report to contact@pinocchiocollectibles.shop. Include:

• A clear description of the vulnerability
• Steps to reproduce the issue
• Impact assessment (what could a malicious actor achieve?)
• Supporting evidence such as screenshots or logs (avoid sensitive customer data)

Report a Security Issue

Responsible Disclosure Expectations

• Provide us reasonable time to investigate and remediate before public disclosure.
• Do not exploit vulnerabilities beyond what is necessary to demonstrate them.
• Do not access, modify, or delete customer data.
• Comply with all applicable laws while researching.

Order or Account Concerns

If you suspect that your account or a recent order was affected by unauthorized activity, please contact us immediately. Do not share your password or full payment details by email — we will never ask for them.

Contact Information

Business Hours

• Monday – Friday: 9:00 AM – 9:00 PM
• Saturday: 10:00 AM – 10:00 PM
• Sunday: Closed