01Reporting a vulnerability
If you believe you have found a security weakness in ParcelMood, please tell us at legal@parcelmood.ai with the subject "Security". Include what you found, the page or address concerned, the steps to reproduce it, and what an attacker could do with it.
Our security contact is also published at parcelmood.ai/.well-known/security.txt.
02Please
- test only against your own store account or the public demo pages, never against another store's data or a real buyer's page;
- stop as soon as you reach data that is not yours, do not keep or share it, and tell us what you saw;
- do not run denial-of-service tests, spam, social engineering or physical tests, and do not use automated scanners that send large volumes of requests;
- give us a reasonable time to fix the issue before you publish anything about it.
03What we do
We confirm receipt within five working days, keep you informed while we investigate, and tell you when the issue is fixed. If you wish, we will credit you when we describe the fix.
We will not pursue or support legal action against anyone who reports a vulnerability in good faith and follows these rules.
We do not currently offer payment for reports.
04Scope
In scope: parcelmood.ai and its pages and interfaces. Out of scope: the services of our providers (their own disclosure programmes apply), and findings with no security impact, such as missing best-practice headers on their own or reports produced only by automated tools.
If a vulnerability involves personal data, we assess it under our personal data breach procedure and notify the authority and the people affected where the law requires.