Effective
1. How to report
Email security@orderfy.com.au with what you found, how to reproduce it and what you think the impact is. Machine-readable details are in /.well-known/security.txt.
Please include the address or screen affected, the steps to reproduce it, and any proof of concept. Do not include other people's personal information.
2. What to expect
- We acknowledge your report within 2 business days.
- We confirm the problem, rate its severity and tell you what we found.
- Target fix times: critical 7 days, high 30 days, medium 90 days.
- We keep you posted until it is fixed.
- We credit you when the fix ships, if you want to be credited.
3. In scope
The Orderfy website (orderfy.com.au), the Orderfy app, the sign-in pages and the public API.
4. Out of scope
- Services run by our suppliers, which have their own disclosure programmes
- Reports from automated scanners with no demonstrated impact
- Missing best-practice headers or settings with no practical attack
- Anything that needs physical access to a device, or a device that is already compromised
5. Please don't
- access, change or delete data that isn't yours
- run denial-of-service tests, spam or social engineering against our staff or customers
- keep data you came across, beyond what is needed to show the problem
- share the problem publicly before we have fixed it
6. Safe harbour
If you act in good faith and within this policy, we won't take legal action against you, or ask anyone else to, for your research. If a third party complains about research done within this policy, we'll make it known that you acted with our permission. If you're not sure whether something is within it, ask us first at the address above.
7. Rewards
We do not run a paid bug bounty. We thank researchers publicly, with their permission, when a fix ships.
Trade Sync Group Pty Ltd (ABN 65 668 818 791), trading as Orderfy · Unit 14 / 9 Bermill Street, Rockdale NSW 2216