Vulnerability Disclosure Policy

Pied Parker takes the security of our parkers, our operators and their data seriously. If you believe you have found a security vulnerability in one of our services, we want to hear from you. This page explains what is in scope, how to report, and what you can expect from us.

Reporting a vulnerability

Email security@piedparker.com. Please include:

  • The service, URL or app version affected;
  • Steps to reproduce, with any request/response samples or screenshots;
  • The impact you believe the issue has;
  • How you would like to be credited, if at all.

We publish this policy and contact in machine-readable form at /.well-known/security.txt (RFC 9116).

Scope

The following are in scope:

  • piedparker.com and its subdomains;
  • pied.cloud and its subdomains, including backend.pied.cloud and commercial.pied.cloud;
  • The Pied Parker mobile apps for iOS and Android.

Out of scope: services operated by third parties (payment processors, email providers, hosting providers) — please report those to the vendor concerned; physical security of parking facilities and on-site hardware; and the parking operators who use our platform.

Rules of engagement

Please:

  • Only test against accounts, vehicles and payment methods you own or have permission to use;
  • Stop and report as soon as you have enough to demonstrate the issue — do not access, modify or retain data that is not yours. If you encounter someone else's personal data, stop and tell us;
  • Do not run denial-of-service tests, spam, or attacks that degrade the service for parkers;
  • Do not use social engineering, phishing, or physical attacks against our staff, operators or facilities;
  • Give us a reasonable time to fix the issue before disclosing it publicly. We ask for 90 days from your report, and will agree a different date with you where that is not practical.

Reports that consist only of automated scanner output, missing security headers or best-practice recommendations without a demonstrated impact, or issues on pages with no sensitive functionality (such as clickjacking on static marketing pages) will be acknowledged but are unlikely to be acted on as vulnerabilities.

What you can expect from us

  • An acknowledgement within three business days;
  • An honest assessment of the report and, where we agree it is a vulnerability, a fix prioritised by its severity;
  • Updates while we work on it, and confirmation when it is resolved;
  • Public credit for your report if you would like it.

We do not currently run a bug bounty programme and do not offer monetary rewards for reports. We say this up front so nobody is surprised later; we are nonetheless genuinely grateful for good-faith research and will say so.

Safe harbour

We will not pursue legal action against, or report to law enforcement, anyone who researches and reports a vulnerability in good faith and in accordance with this policy. If a third party takes legal action against you for activity that complied with this policy, we will make it known that your actions were authorised by us.