Last updated: 9 September 2026.
We publish PrestaShop modules that run inside other people's shops. A vulnerability in one of them is a vulnerability in every store that installed it, so we would much rather hear from you than not.
How to report
Email security@boutiqueshop-modules.com with:
- which module and which version (the version is in
config.xmland on the module's page in the back office), - the PrestaShop and PHP versions you saw it on,
- what an attacker could achieve, and
- the steps to reproduce it — a proof of concept is welcome.
If you would rather not use email, info@boutiqueshop-modules.com reaches the same person.
What we commit to
| Acknowledgement | within 1 working day (Monday–Friday) |
| Assessment and a plan | within 3 working days |
| Fix released | within 48 working hours of confirming a genuine vulnerability, for anything remotely exploitable |
| Credit | in the changelog, if you want it — tell us the name to use |
Those first two are the same promise we make to paying customers. The third is the deadline our marketplace agreement holds us to, and we would rather state it publicly than treat it as an internal target.
What we ask of you
- Give us a reasonable chance to fix it before you publish. We will not ask you to stay quiet indefinitely, and we will not threaten you for reporting in good faith.
- Test against your own installation. Do not test against other people's shops, do not access data that is not yours, and do not run denial-of-service or spam tests.
- Report what you found rather than how far you could get.
Out of scope
- PrestaShop core itself — report those to the PrestaShop project.
- Third-party modules and themes we did not write.
- Findings from automated scanners with no demonstrated impact.
- Missing hardening headers on the marketing site with no exploitable consequence.
No bounty
We are a one-person business and do not run a paid bounty programme. We will credit you, fix it quickly, and say thank you properly.