Security
Reporting a vulnerability
If you have found a security problem in this platform, we want to hear about it, and we would rather hear about it from you than read about it.
How to report
Email the association’s security contact. Include enough detail to reproduce the issue — a URL, a request, the account state it needs. If you would rather encrypt the report, say so and we will exchange keys first.
Our machine-readable contact details are at
/.well-known/security.txt.
What to expect
- Acknowledgement within three business days
- From a person, not an autoresponder.
- An assessment within ten business days
- Telling you whether we agree it is a vulnerability, and if so what we intend to do. If we disagree, we will say why rather than going quiet.
- Credit if you want it
- We are happy to name you when the fix ships, and equally happy not to.
Safe harbour
We will not pursue legal action against anyone who reports in good faith and stays inside the boundaries below. If you are unsure whether something is in scope, ask first — we would rather answer a question than receive an apology.
Please do:
- Test against accounts you control
- Stop as soon as you have confirmed a finding
- Give us reasonable time to fix before disclosing publicly
Please do not:
- Access, modify or download data belonging to another member
- Run denial-of-service or load tests
- Social-engineer our staff, our members, or their drivers
- Test physical premises
The third one matters here more than it does elsewhere. Our members' employees include drivers who are already targeted by freight fraud, and a plausible-looking test call is indistinguishable from the real thing at the receiving end.
This is not a bug bounty
We do not pay for reports today. We would rather say that plainly than run a bounty we cannot staff — reports arriving faster than anyone can triage them helps nobody, least of all the researcher waiting for a reply.