Security is something we take seriously. We protect customer data, payments, and accounts with industry-standard tools — but no system is bulletproof. If you’ve spotted a vulnerability, suspicious activity, or anything that looks like a security risk on boxedcss.com, we want to hear about it.
What to Report
- Website vulnerabilities — bugs, exploits, or weaknesses in our code.
- Account issues — suspicious logins, unauthorized access, or hijacked accounts.
- Payment fraud — unauthorized charges or suspicious billing activity.
- Phishing attempts — fake emails or websites pretending to be Boxedcss.
- Data exposure — leaked customer information or credentials.
- Malware or scams — suspicious links, downloads, or fraudulent ads claiming to be from us.
- Social engineering — anyone impersonating Boxedcss staff or customers.
If you’re not sure whether something counts, report it anyway. We’d rather get a false alarm than miss a real threat.
How to Report
Email contact@boxedcss.com with “SECURITY REPORT” at the start of the subject line, and include as much detail as you can:
- A clear description of the issue.
- Where you found it (URL, page, or account section).
- Steps to reproduce it, if it’s a website vulnerability.
- Screenshots or recordings, if you have them.
- The date and time you discovered it.
- Your contact information so we can follow up.
What Not to Do
- Publicly disclose the issue before we’ve had a chance to fix it.
- Share the vulnerability with third parties or post it on forums.
- Exploit the issue beyond what’s needed to confirm it exists.
- Access, modify, or download other users’ data.
- Run automated scans, brute-force attacks, or denial-of-service tests against our site.
- Use the issue for personal gain, fraud, or extortion.
What Happens After You Report
- Acknowledgment. We confirm we received your message within 2 business days.
- Investigation. We review and verify the report, usually within 3–7 business days.
- Resolution. Once confirmed, we fix the vulnerability as quickly as we can.
- Follow-up. We let you know when it’s resolved and may credit you publicly, with your permission.
We don’t run a paid bug bounty program, but we appreciate every responsible report and may offer recognition where appropriate.
If Your Account Has Been Compromised
- Change your password immediately, on Boxedcss and anywhere else you reused it.
- Email contact@boxedcss.com with the subject line “ACCOUNT COMPROMISED.”
- Include order history details so we can verify your identity.
- Check your bank statements for unauthorized charges and contact your bank if needed.
We’ll lock the account, review recent activity, and help you recover access safely.
Phishing and Fake Boxedcss Messages
Boxedcss will never:
- Ask for your password by email, phone, or text.
- Request your full card number outside our secure checkout.
- Send links asking you to “verify” your account on a third-party site.
- Demand payment in gift cards, cryptocurrency, or wire transfers.
- Threaten to close your account unless you act immediately.
If you receive a suspicious message claiming to be from us, forward it to contact@boxedcss.com and delete it. Don’t click any links inside.
Our Commitment to Security
- TLS encryption on every page of boxedcss.com.
- PCI-compliant payment processing through trusted providers.
- Hashed password storage — we never store passwords in plain text.
- Regular security reviews to identify and patch issues.
- Internal access to customer data restricted on a need-to-know basis.
Legal Safe Harbor
If you report a security issue in good faith, follow this policy, and don’t damage our systems or customer data, we won’t pursue legal action against you. We treat responsible reporters as partners, not adversaries. This safe harbor doesn’t apply if you break the rules above or violate federal or state law while researching the issue.
Contact Us
Boxedcss
706 12th St, Greeley, CO 80631, United States
Phone: +1 (970) 552-7801
Email: contact@boxedcss.com
Website: www.boxedcss.com