Responsible disclosure policy

The security of PickleDeck is a priority. If you are a security researcher or an attentive user and you identify a vulnerability, we invite you to report it to us through the channel described below. We undertake to handle every report with seriousness, transparency and recognition.

Send an email to security@pickledeck.com including:

• A clear description of the vulnerability
• The steps to reproduce it (URL, payload, screenshot if useful)
• The estimated impact (confidentiality, integrity, availability)
• Your name or pseudonym (for recognition)
• Any proposed fix or mitigation

For particularly sensitive reports, you can ask us for a PGP key before sending.

In scope

• pickledeck.com and all its production subdomains
• iOS and Android mobile applications published under the PickleDeck publisher account
• Public APIs and webhook endpoints (HelloAsso, Stripe, DUPR)
• GDPR vulnerabilities: exposure of personal data, RLS bypass
• Authentication, authorisation and privilege escalation vulnerabilities
• Injections (SQL, XSS, SSRF, CSRF, etc.)
• Payment and accounting flaws

Out of scope

• Denial-of-service attacks (DDoS) or stress tests
• Social engineering attacks targeting our employees or users
• Physical attacks on our offices or our providers
• Vulnerabilities in third-party services we do not control (Stripe, Supabase, Vercel, Cloudinary, Resend): report them directly to those providers
• Flaws requiring physical access to the user's device
• Automated reports without a demonstration of real exploitability
• Configuration of SPF/DKIM/DMARC-type headers on subdomains not used for email
• Lack of best practice without demonstrable impact (e.g. no stricter CSP)
• Outdated library versions without an exploitable CVE

We will not take legal action against researchers who:

• Act in good faith and in the spirit of this policy
• Avoid any breach of the confidentiality of user data (use test accounts, not other people's real accounts)
• Do not degrade or interrupt the service
• Do not disclose the vulnerability publicly before it is fixed and we have had a reasonable time to communicate (90 days by default)
• Comply with applicable laws

This commitment does not cover clearly malicious acts (extortion, resale of data, intentional damage).

PickleDeck does not (yet) run a financial rewards programme (bug bounty). However, we recognise security contributors in several ways:

• Public mention on this page (with your agreement)
• A personalised reply and written thanks
• For major contributions: a PickleDeck goodie and early access to new features

A financial bug bounty programme will be set up as the platform scales up. Stay tuned.

6. Hall of fame

No public reports to date. You could be the first.

7. Changes to this policy

This policy is reviewed annually (next review: May 2027) and may change as the programme matures. The date of the last update appears at the top of the page. Major changes are announced on the security@pickledeck.com channel.