Vulnerability Disclosure Policy

1. Introduction & General Statement

At WarrantyTracker Pro (referred to herein as the "Company"), we value the security community and appreciate the responsible disclosure of potential security vulnerabilities. If you believe you have discovered a security vulnerability affecting the Company's application, infrastructure, or Company-controlled configuration, we encourage you to notify us promptly.

This Vulnerability Disclosure Policy (the "Policy") establishes the legally binding terms, expectations, and rules of engagement for reporting security vulnerabilities to the Company.

IMPORTANT NOTICE: This Policy does not establish, imply, or authorize any financial compensation, bug bounty, reward, or swag program. All submissions are made on a voluntary, non-compensable basis.

2. Safe Harbor & Legal Authorization

The Company considers good-faith security research conducted in strict accordance with this Policy to be authorized conduct.

Provided that you fully comply with the terms of this Policy, the Company agrees:

• Civil and Criminal Immunity: Not to initiate or support legal action against you under applicable computer crime or anti-hacking laws, including but not limited to the Computer Fraud and Abuse Act (CFAA) or the Digital Millennium Copyright Act (DMCA), to the extent applicable.
• Exclusion of Breach Claims: Not to assert claims against you for breach of contract, unauthorized access, or terms-of-service violations arising solely from security research that is authorized under and conducted in compliance with this Policy.
• Third-Party Limitation: The Company does not control, represent, or provide authorization on behalf of third parties. If a third party initiates legal action against you, the Company will, to the extent legally permissible, make its authorization known to the appropriate authorities or relevant third party. The Company cannot bind or prevent third parties, law enforcement, external service providers, vendors, cloud providers, or other independent entities from pursuing their own legal remedies.

The protections in this Section apply only to activities directed at Company-controlled assets and conducted in accordance with this Policy. They do not authorize testing of third-party systems or services.

3. Scope of Authorization

This Policy applies exclusively to digital assets owned, operated, or directly controlled by the Company, including:

• warrantytracker.pro
• All direct and indirect subdomains associated with the Company's domain, including *.warrantytracker.pro
• Company-controlled applications, APIs, infrastructure, and services expressly identified as in scope.

3.1 Third-Party Services, Vendors, and Dependencies

The Company may use third-party products, services, software, infrastructure, APIs, SaaS platforms, cloud providers, libraries, open-source components, payment processors, identity providers, hosting providers, analytics platforms, or other external services in connection with its systems.

Third-party systems and vulnerabilities are expressly outside the scope of this Policy.

A vulnerability that exists solely within a third-party product, service, infrastructure, application, library, API, platform, or other technology is not a vulnerability of the Company for purposes of this Policy and should be reported directly to the applicable third party, vendor, service provider, or maintainer.

Examples include, without limitation:

• A vulnerability in a third-party SaaS application;
• A vulnerability in a cloud provider's underlying infrastructure;
• A vulnerability in a third-party API;
• A vulnerability in a third-party software library or open-source dependency;
• A vulnerability in a vendor's authentication, authorization, or access-control implementation;
• A vulnerability in a third-party product or service that is used by the Company but is not caused by the Company's configuration or implementation.

3.2 Company Configuration or Integration Issues

Notwithstanding the foregoing, vulnerabilities caused by a Company-controlled configuration, implementation, integration, or deployment of a third-party service may be within scope when the security impact results from an action, configuration, or implementation controlled by the Company.

For example, a report may be within scope where:

• The Company has incorrectly configured access controls for a third-party service;
• The Company has improperly exposed a third-party service or resource;
• The Company's integration with a third-party service creates an unintended authentication or authorization bypass;
• Company-controlled credentials, tokens, permissions, webhooks, API configurations, or security settings expose Company data or systems;
• A Company-controlled integration causes a third-party service to be used in an unintended or insecure manner.

In such circumstances, the report should focus on the Company-controlled configuration or integration and its resulting security impact, rather than attempting to test, exploit, or remediate the underlying third-party system.

The Company is not responsible for independently remediating vulnerabilities that reside within the third-party service itself.

3.3 Strictly Out of Scope

The following are strictly excluded from this Policy unless expressly identified in writing by the Company:

• Systems, applications, infrastructure, or services not owned or controlled by the Company;
• Third-party SaaS tools and platforms;
• External cloud-provider infrastructure;
• Vendor-managed systems;
• Third-party APIs and integrations, except to the extent of a Company-controlled configuration or integration vulnerability;
• Third-party software, libraries, frameworks, and open-source components where the vulnerability resides in the underlying component;
• Physical infrastructure and facilities;
• Employee-owned or contractor-owned personal devices;
• Customer-owned systems or environments;
• Systems belonging to other organizations or individuals.

Researchers must not attempt to exploit, compromise, scan, or otherwise test third-party systems merely because those systems are accessible through, integrated with, or used by the Company.

4. Rules of Engagement & Prohibited Activities

Any violation of this section may immediately revoke your authorization and terminate the Safe Harbor protections provided under Section 2.

You must strictly avoid the following:

• Denial of Service (DoS): Executing Denial of Service (DoS/DDoS), stress testing, brute-force attacks, resource exhaustion, or deploying automated scanners that degrade, disrupt, or impair the performance or availability of Company systems.
• Social Engineering: Conducting phishing, vishing, spear-phishing, pretexting, or any other form of psychological or physical manipulation against Company employees, contractors, customers, partners, vendors, or other individuals.
• Third-Party Testing: Testing, exploiting, scanning, or attempting to compromise third-party systems, services, infrastructure, applications, APIs, or accounts, even where those systems are integrated with or accessible through Company systems.
• Data Privacy & Minimal Data Access: If you accidentally encounter or gain access to sensitive data—including but not limited to personally identifiable information (PII), payment card data, credentials, authentication tokens, or proprietary business information—you must cease testing immediately. You may access, download, capture, or retain only the absolute minimum information reasonably necessary to demonstrate the vulnerability. Any retained copies must be securely destroyed after submission of the report.
• Malicious Exploitation: Using a discovered vulnerability to pivot to unrelated internal networks, establish persistent access, modify or delete production data, install malware or backdoors, deploy cryptocurrency miners, or otherwise maintain unauthorized access.
• Third-Party Escalation: Using a Company vulnerability as a means to gain unauthorized access to a third party or to conduct testing beyond the Company's authorized environment.

If exploitation of a Company-controlled vulnerability necessarily results in interaction with a third-party service, researchers must limit activity to the minimum necessary to demonstrate the Company-controlled security issue and must not continue testing the third party's systems.

5. Third-Party Vulnerability Reporting

Where a reported issue is determined to reside solely within a third-party product, service, infrastructure, application, library, or other external dependency, the Company may classify the submission as a Third-Party Vulnerability.

In such circumstances:

• The researcher should submit the vulnerability directly to the relevant third party, vendor, service provider, or maintainer through its applicable vulnerability disclosure or security reporting process.
• The Company does not assume responsibility for investigating, validating, remediating, or coordinating disclosure of the underlying third-party vulnerability.
• The Company may, at its discretion, notify or coordinate with the relevant third party if the issue affects the Company's use of that service.
• The Company may request additional information necessary to determine whether the issue arises from the third-party technology itself or from a Company-controlled configuration or integration.
• The Company will not treat a third-party vulnerability as a Company security vulnerability solely because the affected third-party technology is used by, accessible from, or integrated with Company systems.

Where the issue results from a Company-controlled configuration, implementation, or integration, the report may remain within the scope of this Policy to the extent of that Company-controlled issue.

6. Coordinated Disclosure & Confidentiality Obligations

This Policy operates under a framework of Coordinated Vulnerability Disclosure.

By participating, you agree to keep all details, findings, descriptions, evidence, and existence of a reported vulnerability confidential.

You shall not publish, share, blog, tweet, disclose, or otherwise communicate the vulnerability or related confidential information to any third party or the public until the Company has formally confirmed that the issue has been successfully remediated or has provided written authorization for disclosure.

This confidentiality obligation does not require the researcher to withhold information from a third-party vendor when the reported issue is determined to be a third-party vulnerability and the researcher is submitting the issue directly to that third party.

Researchers should avoid disclosing Company confidential information when reporting a third-party vulnerability and should provide only the information reasonably necessary for the third party to investigate and remediate its vulnerability.

7. Submission Guidelines

To report a vulnerability affecting a Company-controlled asset, please contact our security team at:

vulndis@mail.warrantytracker.pro

Reports should be submitted in clear, written text and should include, where applicable:

• A detailed description of the vulnerability;
• The affected URL, endpoint, application, subdomain, or other Company-controlled asset;
• The potential technical and security impact;
• Step-by-step instructions or an isolated Proof of Concept (PoC) to reliably reproduce the issue;
• Relevant scripts, screenshots, HTTP requests, response headers, or other evidence;
• Identification of any data that was inadvertently accessed during discovery;
• Identification of any third-party service involved in the issue;
• An explanation of whether the suspected vulnerability appears to arise from the third-party technology itself or from a Company-controlled configuration or integration.

Third-Party Issues

If you believe the vulnerability resides primarily or exclusively in a third-party product or service, you should report it directly to that third party.

If there is uncertainty regarding whether the issue is caused by the third party or by a Company-controlled configuration or integration, the researcher may submit the report to the Company for clarification. The Company may direct the researcher to the appropriate third-party security contact where appropriate.

8. Timeline & Communications

The Company will make reasonable, good-faith efforts to respond to submissions.

• Acknowledgment: We aim to acknowledge receipt of a report within 3 business days.
• Initial Assessment: The Company may assess whether the reported issue affects a Company-controlled asset, a Company-controlled configuration or integration, or a third-party product or service.
• Remediation Updates: Where the issue is determined to be within the Company's control, we will make reasonable efforts to provide updates regarding validation and remediation.
• Third-Party Issues: Where the issue is determined to be solely a third-party vulnerability, the Company may notify the researcher that the issue should be submitted directly to the applicable third party. The Company may, but is not obligated to, coordinate with that third party regarding the issue.

The Company does not guarantee a specific remediation timeframe.

9. Intellectual Property & Waiver

By submitting a report to the Company, you grant the Company a perpetual, irrevocable, worldwide, royalty-free, non-exclusive license to use, reproduce, modify, adapt, and distribute the submission and its contents for security, operational, legal, compliance, or business purposes.

You waive any claim to compensation or attribution arising solely from the submission of the report, except where otherwise expressly agreed to in writing by the Company.

This Policy does not transfer ownership of intellectual property in a researcher's independently developed tools, methodologies, or pre-existing materials. The license granted above applies to the vulnerability report and materials submitted to the Company to the extent necessary for the Company to evaluate, investigate, remediate, document, and address the reported issue.

10. No Obligation to Accept or Remediate

The Company reserves the right to determine, in its reasonable discretion, whether a reported issue:

• Falls within the scope of this Policy;
• Constitutes a security vulnerability;
• Results from a Company-controlled system, configuration, or integration;
• Is instead a vulnerability in a third-party product or service;
• Requires remediation; or
• Has been sufficiently demonstrated by the submitted evidence.

The Company is not obligated to remediate vulnerabilities that are determined to exist solely within third-party products, services, infrastructure, or dependencies.

Nothing in this Policy requires the Company to disclose internal security information, remediation details, risk assessments, or other confidential information to a researcher.

11. Changes to This Policy

The Company may modify this Policy from time to time. The version of the Policy in effect at the time the relevant security research is conducted will generally govern that research, subject to any applicable legal requirements.

The Company may terminate or modify the Policy prospectively by publishing an updated version or otherwise providing notice.