Found a vulnerability? Tell us first.

• The Numeristic WordPress plugin, every version, including pilot test builds.
• The site on numeristic.com, the app on app.numeristic.com, and the ingest endpoints the plugin sends to.

Email contact@numeristic.com. English or Romanian. Tell us:

• what is affected: the plugin version, or the page or endpoint;
• how to reproduce it, step by step;
• what an attacker could do with it, and whether you have seen it used.

Leave out personal data of shop customers. If a report needs it, we will agree a way to send it.

• We confirm we have your report within 2 working days.
• Within 7 days we tell you whether we can reproduce it and how serious we think it is.
• We fix it, tell you when the fix is out and, if you want, credit you in the release notes.
• We ask you to keep it private until a fix is available, or for 90 days, whichever comes first. If we need longer, we will say why.

We will not take legal action against research that follows these rules:

• test only shops and accounts you own or have written permission to test;
• do not read, change or keep other accounts' data beyond what proves the issue, and stop as soon as you reach it;
• no denial of service, spam, social engineering or physical access;
• give us reasonable time to fix before you publish.

There is no bug bounty.

Artificial Systems SRL is the manufacturer of the Numeristic WordPress plugin under Regulation (EU) 2024/2847. When a vulnerability in the plugin is actively exploited, or a severe incident affects its security, we report it through ENISA's single reporting platform to the Romanian national CSIRT: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report after a fix is available. We tell affected shops what happened and what to do.

Pilot builds of the plugin are made available for a limited period, for testing only, under Article 4(3) of the Regulation, and say so on the plugin's admin page.