Security and responsible disclosure

How to report

• What is vulnerable and the impact: what an attacker could do.
• Steps to reproduce: addresses, requests, screenshots or a video.
• The account or shop you tested on (your own).
• How to reach you and whether you'd like a public thank-you.

Don't send other people's personal data, even if you saw it: describing what was visible is enough.

In scope

• The builder, the CRM, the operator console and the platform's marketing site.
• The Platform API and app keys.
• The platform's part of published shops: the cart, checkout, payment, the shopper's account.
• Isolation of the agent's sandboxes and published shops from each other and from the platform.

Out of scope

• Content shop owners created: report fraud or prohibited content through the report form at the bottom of the shop.
• Denial of service, load testing, spam.
• Social engineering of our staff or users, physical access.
• Third-party services (Cloudflare, payment providers, delivery services) — report to them directly.
• Automated scanner reports and missing headers without a confirmed attack scenario.

Good-faith research rules

• Test only on your own accounts and shops.
• If you reach other people's data, stop: don't view, copy or keep more than the proof needs.
• Don't change or delete data, don't degrade the service for others.
• Don't disclose the vulnerability until we've fixed it — or 90 days after your report, unless we agreed on another date.

What we do

• Acknowledge your report within 3 business days.
• Give a first assessment within 10 business days.
• Fix it: critical — as soon as possible (aiming for 7 days), high — within 30 days, the rest — within 90 days.
• Keep you posted on the fix and on when it can be made public.
• With your consent, thank you on this page.

Safe harbour for good-faith researchers

• We consider research under these rules authorised and won't take legal action over it.
• If a third party makes claims against you over such research, we'll confirm you followed our policy.

There's no monetary reward for findings yet.

Thanks

Empty so far — you could be the first.