Responsible Disclosure
How to report a suspected security issue in ShowPoppy™, and what happens next.
If you believe you have found a security issue in ShowPoppy™, we want to hear about it directly, before it is shared publicly.
Report it through the support form, choosing Security as the subject. It reaches us directly.
Please include the steps to reproduce, the affected page or endpoint, and what you were able to access or change.
What we ask of you
- Give us a reasonable opportunity to investigate and address the issue before disclosing it publicly.
- Do not access, modify, or delete data belonging to anyone other than yourself.
- Do not run tests that degrade service for other people, including denial of service or bulk automated scanning.
- Do not use social engineering, physical access, or attacks against our staff or vendors.
What we will do
- Acknowledge that we received your report.
- Investigate and keep you informed of what we find.
- Tell you when we consider the issue resolved.
- Credit you if you would like to be credited, and if the report leads to a change.
Scope
This applies to the ShowPoppy™ web application and the public pages on this site. Third-party services we rely on should be reported to those providers directly.
What this page does not promise
We do not currently operate a paid bug bounty, and we do not publish a fixed response time. We also make no claim on this page about specific security controls, certifications, or audits. If you are evaluating ShowPoppy™ for a brokerage or enterprise and need detail beyond this, contact us using the address above and say so.