# Security contact information for DMC Pilot
# https://www.rfc-editor.org/rfc/rfc9116

Contact: mailto:security@dmcpilot.com
Expires: 2027-01-31T05:31:24Z
Preferred-Languages: en
Canonical: https://dmcpilot.com/.well-known/security.txt
Policy: https://dmcpilot.com/aup#security

# What we commit to
#
#   We acknowledge a report within two working days, keep you informed while we
#   investigate, and tell you when it is fixed. We will credit you if you would
#   like to be credited. We will not pursue legal action against research carried
#   out in good faith under the terms below.
#
#   We do not currently run a paid bug bounty. We would rather say so than imply
#   one.
#
# What good faith means
#
#   Test only with accounts and data you own or have explicit permission to use.
#   Stop at proof of a vulnerability. Do not pivot further into the system.
#   Never access, modify, exfiltrate or retain another organization's data.
#   No denial-of-service or load testing. No social engineering of our staff,
#   our customers or our suppliers. No physical intrusion.
#   Give us reasonable time to remediate before disclosing publicly.
#
# Especially interested in
#
#   Anything crossing a tenant boundary. Multi-tenancy is enforced by row-level
#   security in Postgres, and a way around that is the most serious class of bug
#   this product can have.
#
#   Anything reaching data through a token-based portal (vendor, client, driver,
#   photographer or guest links) beyond the scope that link was issued for.
#
#   Anything that exposes dietary or allergy data, which is special category
#   data under Article 9 of the GDPR and is held encrypted under a separate key.
#
#   Server actions missing their own authorization check. Every one is treated as
#   a public endpoint by policy; a counterexample is a real finding.