Reporting a Vulnerability
If you believe you've found a security vulnerability in BookingNinja, we'd like to hear from you. Please report it by emailing [email protected] with as much detail as possible, including:
- A description of the vulnerability and its potential impact
- Steps to reproduce the issue
- Any supporting material such as screenshots, proof-of-concept code, or logs
We ask that you do not publicly disclose the vulnerability until we've had a reasonable opportunity to investigate and address it.
What to Expect
- Acknowledgement: We will acknowledge your report within 48 hours.
- Assessment: We aim to provide an initial assessment and expected resolution timeline within 5 business days.
- Updates: We will keep you informed of our progress towards a fix.
- Credit: With your permission, we are happy to credit you publicly for the discovery once the issue has been resolved.
Scope
This policy covers vulnerabilities in:
- The BookingNinja web application (app.bookingninja.io)
- The BookingNinja marketing site (bookingninja.io)
- BookingNinja APIs
The following are out of scope:
- Social engineering or phishing attacks against BookingNinja staff or customers
- Denial of service (DoS/DDoS) attacks
- Automated scanning or testing that degrades service for other users
- Vulnerabilities in third-party services, libraries, or infrastructure not under our direct control
- Issues that require physical access to a user's device
- Email configuration issues such as DKIM, SPF, or DMARC settings
- Reports from automated vulnerability scanners without a validated proof of concept
Safe Harbour
We will not pursue legal action against researchers who:
- Act in good faith and in accordance with this policy
- Avoid accessing, modifying, or deleting data belonging to other users
- Do not degrade or disrupt BookingNinja services
- Report vulnerabilities promptly and allow reasonable time for resolution before any disclosure
Testing Guidelines
If you are testing for vulnerabilities, please:
- Only use accounts you own or have explicit permission to test
- Do not access, store, or exfiltrate customer data
- Stop and report immediately if you accidentally encounter another user's data
- Limit the impact of your testing on service availability
Testing Environment
We can provide a dedicated test account with a sample venue for researchers to use during testing. To request access, email [email protected] and we will set one up for you. This allows you to test safely without risk to production data or other customers.
Report Quality
We will not engage with vague or incomplete reports. Emails such as "I have found a vulnerability" without supporting detail, or requests to schedule a call before disclosing the nature of the issue, will not receive a response. All reports must include a clear description of the vulnerability and steps to reproduce it. We are happy to work with researchers on incomplete findings, but we need enough technical detail to understand and verify the issue.
Bug Bounty
We offer small rewards for valid, responsibly disclosed vulnerabilities based on severity:
- Low (information disclosure, misconfiguration with minimal impact): £25
- Medium (access control issues, data leakage affecting a single account): £75
- Critical (authentication bypass, SQL injection, access to other customers' data): £200
Bounties are paid at our discretion once the vulnerability has been verified and resolved. To be eligible, reports must:
- Be the first report of the vulnerability
- Include a clear, manually validated proof of concept
- Follow the guidelines in this policy
Reports generated solely or primarily through automated scanning tools are not eligible for a bounty. We expect researchers to validate findings manually before submitting.
Contact
For security reports: [email protected]
For general enquiries, please use our standard support channels rather than the security contact.