Responsible Disclosure Program

Out of scope

• Denial-of-service or stress-testing without prior written approval.
• Social engineering of staff, suppliers, or customers.
• Physical attacks on offices, data centers, or hardware.
• Findings derived from spam, phishing, or unsolicited content posted by third parties.
• Vulnerabilities requiring a stolen or rooted device with prior physical access.
• Cookie / session-issue findings without a demonstrable security impact.

Ground rules

• Test only against accounts and data you own or have explicit permission to test.
• Avoid privacy violations, service disruption, and destruction of data.
• Do not publicly disclose a vulnerability until we have had a reasonable opportunity to fix it.
• Do not extort, threaten, or demand payment as a condition of reporting.

Safe harbor

Disclosure process

1. 1Email security@partsperk.com with a clear description, reproduction steps, and expected impact. PGP encryption available on request.
2. 2We acknowledge within 2 business days, triage within 5 business days, and assign a severity using a CVSS-aligned rubric.
3. 3We provide status updates at least every 14 days until resolution.
4. 4Coordinated public disclosure — typically within 90 days of confirmed report — once the fix is deployed and customers have had reasonable time to update.

Rewards

We do not currently operate a paid bounty program, but high-quality reports are eligible for swag, recognition, and an entry on our hall-of-fame on request.