Vulnerability Disclosure Policy

1. Our commitment

ChefNet handles verified dining data, payments through Stripe, and personal profiles. We want to hear about weaknesses before anyone else does. If you follow this policy in good faith, we will work with you, not against you.

2. How to report

• Email chefnet.app@gmail.com with the subject [Security]. Include the affected URL or component, steps to reproduce, the impact you observed, and any proof-of-concept (screenshots, requests).
• Do not include other people's personal data in the report. If you found it, tell us where — do not copy it.
• We acknowledge reports within 3 business days, give a first assessment within 10 business days, and keep you informed until the issue is fixed.

3. Scope

• https://chefnet.app including /app/, /admin/, /api/ and /kiosk/.
• The ChefNet mobile apps (Android, iOS) and their backend.
• Out of scope: third-party services we use (Stripe, Supabase, DigitalOcean, Google Fonts), denial-of-service or volumetric testing, social engineering of our staff or restaurant partners, physical attacks, and findings that only report missing best-practice headers without a demonstrated impact.

4. Rules of engagement

• Test only against accounts you own or have explicit permission to use. Never access, modify or delete data that is not yours.
• Stop and report as soon as you can demonstrate the issue; do not pivot further.
• No automated scanning at a rate that degrades the service, and no spam, phishing or fake reviews as part of testing.
• Give us a reasonable time to fix the issue before any public disclosure — we aim for 90 days and will agree a date with you.

5. Safe harbour

Research carried out in line with this policy is authorised. We will not pursue legal action against, or report to law enforcement, anyone who complies with it, and we will not claim that such research violates our Terms of Use. If a third party takes action against you for research done under this policy, we will make it known that you acted in accordance with it.

6. Recognition

We do not run a paid bug-bounty programme yet. With your permission we list researchers who reported valid issues on this page. Nobody has been listed so far.