Security Policy
Vulnerability disclosure for Rate My Vet. Machine-readable version: /.well-known/security.txt
1. How to report
Email security@ratemyveterinarian.com, or use the contact form if you would rather not send mail. Please do not open a public issue.
A report is much faster to act on when it includes:
- What the issue is, and what an attacker gets out of it
- Steps to reproduce, or a proof of concept
- The affected area — a URL, an API endpoint, a page
- Your assessment of severity, if you have one
2. What we commit to
Clocks start when your report arrives. Acknowledge means a person has replied and the report is with someone — not an autoresponder. Triage means we have reproduced it or told you why we could not, and assigned a severity. Fix means a fix is deployed, or a mitigation is in place and we have told you what risk is left.
| Severity | Acknowledge | Triage | Fix or mitigate |
|---|---|---|---|
| Critical | 24 hours | 48 hours | 7 days |
| High | 48 hours | 5 business days | 30 days |
| Medium | 48 hours | 5 business days | 90 days |
| Low | 5 business days | 10 business days | Next scheduled release |
- Critical
- Unauthenticated remote code execution, authentication bypass, read access to the whole database, mass exposure of personal data.
- High
- Privilege escalation, IDOR returning another account's data, stored XSS on a page any signed-in user reaches, SSRF that reaches an internal service.
- Medium
- Reflected XSS needing user interaction, CSRF on a non-destructive action, a rate-limit bypass, information disclosure with no personal data in it.
- Low
- A missing hardening header, an over-talkative error message, anything whose preconditions are implausible in practice.
If a deadline is going to slip we will say so before it does, and say why.
3. Safe harbour
We will not pursue legal action against you for research carried out in good faith under this policy, and we will not report you to anyone else for it. Good faith means: you stop as soon as you have confirmed the issue, you do not access, modify or keep anyone else's data, you do not degrade the service for other people, and you give us 90 days from our first acknowledgement before publishing. If the fix needs longer than that, we will ask — the deadline is there to stop a report going quiet, not to buy silence.
We will credit you in the fix and any advisory unless you would rather we did not. There is no bug bounty; we are not able to pay for reports.
4. Scope
This site and its API. Two things we ask you not to do, because they cost other people rather than us: no automated scanning against production without asking first — write to us and we will point you somewhere it is safe to make noise — and no denial-of-service or load testing at all.
Reports that are only a missing hardening header, a version banner, or output from a scanner with no demonstrated impact are still welcome, but they are the Low band above.