Printed from dollarloanz.com/security/report. Dollar Loans LLC d/b/a Dollar Loanz.

Coordinated disclosure

Found something? We would genuinely like to know.

A published policy, real response times, and a safe-harbor commitment that does not depend on whether we enjoy the finding.

Where to send it

support@dollarloanz.com

Reports go to the address above. We have not set up a separate security inbox, because an unmonitored one is worse than none. Put the subject tag below on it and it skips the general queue.

Subject line:[SECURITY] your one-line summary

The machine-readable version of this policy is at /.well-known/security.txt, as RFC 9116 expects.

Our side of it

What happens after you press send

With clocks on it, because “we will respond promptly” is what a researcher reads just before deciding to publish on their own schedule.

We acknowledge your report
Within 2 business days
We tell you whether we can reproduce it
Within 5 business days
We give you a remediation plan with dates
Within 10 business days
We agree a public disclosure date with you
Within 90 days, sooner where we can

Safe harbor

If you follow the rules above and report to us in good faith, we will treat your research as authorized conduct. We will not pursue civil action against you, we will not report you to law enforcement over it, and if a third party brings an action against you for research that followed this policy, we will say publicly that it was authorized. This commitment covers your research on the systems listed as in scope, and nothing else.

About rewards

We do not run a paid bounty today. What you get instead is a human reply from somebody who can actually fix it, a named credit on this page if you want one, and a straight answer about when it will be fixed. When a paid program exists, it will be announced here first.

Scope

What you may test, and what you may not

The out-of-scope list is not there to make findings inadmissible. It is there because those particular activities hurt customers rather than us.

In scope

dollarloanz.com and www.dollarloanz.com
The public application flow and everything under it
The customer portal, once it is open to customers
Any API endpoint served from those hosts

Out of scope

Anything that needs a denial-of-service, a load test or brute force to demonstrate — tell us the theory instead and we will take it seriously
Social engineering of our staff, our customers or our suppliers
Physical attempts against any premises or person
Reports generated wholly by an automated scanner, with no demonstrated impact
Missing best-practice headers with no exploit path — still welcome, still triaged, just not treated as a vulnerability
Third-party services we do not run, which should go to their own program

The rules you are agreeing to

Short, and all four are about somebody other than us.

Stop as soon as you have demonstrated the issue. Do not go further into the system than you need to.
Never access, copy, alter or keep anybody else’s personal information. If you land in real customer data by accident, stop and tell us at once — that alone is a valid report.
Do not degrade the service for anyone else.
Give us a reasonable window to fix it before you publish, and we will not ask you to sit on it indefinitely.

A report we can act on

A report template, ready to paste

A well-structured report gets triaged sooner. Here is the shape we work from — copy it, fill it in, send it.

A report template, so you don’t have to invent one

Open it in an email

Summary
  One sentence: what an attacker can do that they should not be able to.

Affected surface
  URL or endpoint. In scope for this policy: dollarloanz.com and www.dollarloanz.com.

Steps to reproduce
  1.
  2.
  3.

What you saw
  The response, the data, the state change. Redact anything that is not yours.

Impact
  Who is harmed, and how badly. Be plain about severity — we will be.

Anything that would help us fix it faster
  A proof of concept, a suggested fix, the commit you think caused it.

How you would like to be credited, if at all
  Name, handle, or "no credit please".

If you land in real customer data by accident, stop and tell us — that alone is a valid report and we will treat it as one. And if you would rather report something without leaving a name, that is fine too: send it from anywhere and we will still fix it. See what we hold in the first place on the security page.

Policy effective from 14 September 2026

This contact is valid until 14 September 2027

Credits

People who have found something

The Acknowledgments field in our security.txt points here, so this had better be a page that actually credits people rather than one that talks about crediting them.

Nobody yet — the list starts empty and says so

No vulnerability has been reported to us. That is not a boast: this site has not been independently tested, and an empty credits list on a young company means nobody has looked, not that there is nothing to find. Be the first name on it.

Read the policy and report something

A name goes on this list only with the reporter’s explicit consent and only once the issue is fixed, and the summary never carries enough detail to reproduce anything. If you would rather not be named, say so and you will not be — it changes nothing about how we handle the report.

Not a researcher — just worried about something?

If you think somebody is impersonating us, or something on your account looks wrong, say so and a person will pick it up.

Who you are dealing with, and what it costs

Dollar Loans LLCCredit Access Business: Arranges the funding and charges the Credit Access Business fee, worked out on the amount advanced for each month the agreement runs.
S2 Funding LLCLender of record: Advances the funds and charges interest on the amount advanced, for the whole term. That interest is S2 Funding LLC's part only, and it is not the total cost of credit.

Registration status

Texas credit access business registration: not yet issued

Check our registration status with the Office of Consumer Credit Commissioner

Regulator

Office of Consumer Credit Commissioner
2601 North Lamar Boulevard, Austin, TX 78705

Consumer helpline (800) 538-1579

Fee structure: An arranging fee for each month the agreement runs, charged by Dollar Loans LLC, plus interest for the whole term, charged by S2 Funding LLC, both worked out on the amount advanced. Each is shown in dollars before you sign.
Annual percentage rate: The annual percentage rate counts our fee and S2 Funding LLC's interest as one yearly figure, worked out by the actuarial method Regulation Z sets out. Until our way of calculating it has been checked, this site prints the dollar figures and leaves the rate out. S2 Funding LLC's interest on its own is not the cost of this agreement.
Your right to cancel: You may cancel by midnight of the third calendar day after you sign, at no cost. You return the amount advanced and owe nothing further.
Paying early: There is no prepayment penalty.

$2,000 to $50,000. The amount depends on the vehicle and your application. Full fee schedule at /occc. These disclosures are effective September 14, 2026.