Vulnerability Disclosure Policy

Reporting a Vulnerability

Concierge Drawer handles data for hotels, restaurants, their staff, and their guests. If you believe you have found a security vulnerability in our platform, we want to hear from you.

Email [email protected] with:

• A description of the vulnerability and its potential impact.
• The affected URL, page, or feature.
• Step-by-step instructions to reproduce it, including any proof-of-concept code or screenshots.
• How you would like to be credited, if at all.

Please do not include guest or customer personal data in your report beyond the minimum needed to demonstrate the issue. Our machine-readable contact details are published at /.well-known/security.txt.

For privacy questions or data requests that are not security vulnerabilities, email [email protected].

Scope

In scope

• conciergedrawer.com, including sign-in and guest voucher pages.
• suite.conciergedrawer.com and desk.conciergedrawer.com.
• Emails and text messages sent by Concierge Drawer, such as sign-in links and voucher deliveries.

Out of scope

• Services operated by our subprocessors. Please report those to the vendor directly.
• Denial of service, load testing, or anything that degrades the platform for other users.
• Social engineering, phishing, or physical attacks against our team, customers, or their properties.
• Reports from automated scanners without a demonstrated, exploitable impact.
• Missing security headers, cookie flags, or email authentication records without a demonstrated impact.
• Self-XSS, clickjacking on pages without sensitive actions, and attacks that require a compromised device.

Testing Guidelines

When researching a vulnerability, please:

• Test only against accounts you own or have explicit permission to use.
• Stop as soon as you encounter data that is not yours, do not keep or share it, and tell us in your report.
• Never modify or delete data that does not belong to you.
• Do not send vouchers, emails, or text messages to people who have not agreed to receive them. Use your own email address and phone number.
• Keep automated testing to a low request rate.
• Give us a reasonable amount of time to fix the issue before you disclose it publicly. We ask for 90 days, and we are happy to coordinate a disclosure date with you.

What to Expect

• We will acknowledge your report within 3 business days.
• We will confirm whether we can reproduce the issue and keep you updated as we work on a fix.
• We will let you know when the issue is resolved and, with your permission, credit you for the discovery.

We do not currently offer a paid bug bounty.

Safe Harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not pursue legal action against you for it, and we will not ask law enforcement to investigate you. If a third party brings legal action against you for research conducted under this policy, we will make it known that your activities were authorized by us.

If you are unsure whether something is allowed, email [email protected] before you test.