Critical
First response: 2 hours
Fix shipped: 24-72 hours
RCE, full data exfiltration, auth bypass
We appreciate security research. Below: scope, timelines, what we won't chase you for, and the hall of fame for researchers who've helped.
Please include: reproduction steps, the URL/endpoint affected, any test account you created (don't use real customer data, ever), the impact you think it has. A short video helps.
We will not pursue legal action against good-faith security researchers who:
Researchers who've responsibly disclosed issues to us. With permission to be named.
Email security@ first if you want to confirm something is in scope or coordinate the timing of a complex finding. We'd rather you ask than skip.
security@autodealerpro.io