Back to Home

    Legal Center

    Vulnerability Disclosure Policy

    How to responsibly report security vulnerabilities, our safe-harbor commitment, and our response timelines

    Vulnerability Disclosure Policy

    Last Updated: May 21, 2026 | Effective Date: May 21, 2026 | Version: 1.0

    REPORT A SECURITY ISSUE

    Email security@rentaltide.com. If you follow this policy in good faith, we will not pursue or support legal action against you (Section 4, Safe Harbor). Please give us a reasonable time to fix the issue before disclosing it publicly (Section 7).

    RentalTide Inc. ("RentalTide," "we," "us") welcomes reports from security researchers. This policy explains what is in scope, how to report, what we promise in return, and the rules of engagement. It supplements our Terms of Service and Acceptable Use Policy.

    1. Scope

    1.1 In Scope

    • www.rentaltide.com and our marketing site
    • app.rentaltide.com (the application)
    • api.rentaltide.com and documented public APIs (see API Terms)
    • Official RentalTide mobile applications

    1.2 Out of Scope

    • Third-party services we rely on (e.g., Stripe, AWS, Twilio, SendGrid). Report those to the vendor directly; see Sub-Processors.
    • Operator-hosted sites and operator-controlled content
    • Denial-of-service (DoS/DDoS), volumetric, or load-testing attacks
    • Social engineering of staff, customers, or operators; physical attacks; and attacks requiring a lost/stolen device or rooted/jailbroken device
    • Spam, or findings from automated scanners without a demonstrated, exploitable impact

    2. How to Report

    Email security@rentaltide.com with:

    • A clear description of the vulnerability and its security impact
    • Steps to reproduce (proof-of-concept code, requests, or screenshots)
    • Affected URL(s), parameter(s), or endpoint(s)
    • Any prerequisites and your testing environment
    • How you would like to be credited (Section 6)

    A security.txt file is published at https://www.rentaltide.com/.well-known/security.txt. You may request our PGP key for encrypted reporting.

    3. Our Commitments

    When you report in good faith, we will:

    • Acknowledge your report within 2 business days
    • Provide a triage and severity assessment within 5 business days
    • Keep you informed of remediation progress
    • Target remediation timelines by severity: Critical ~7 days, High ~30 days, Medium ~90 days, Low best-effort (timelines may vary with complexity and third-party dependencies)
    • Not pursue legal action against good-faith researchers who follow this policy (Section 4)

    4. Safe Harbor / Authorization

    We consider security research and disclosure conducted under this policy to be authorized. If you make a good-faith effort to comply with this policy:

    • We will not initiate or support legal action against you for accidental, good-faith violations, including under the U.S. Computer Fraud and Abuse Act (CFAA) and DMCA anti-circumvention provisions, the Canadian Criminal Code (including s. 342.1 and s. 430(1.1)), Australia's Criminal Code Act 1995 computer offences, and New Zealand's Crimes Act 1961 (ss. 249-252).
    • We waive any restriction in our Terms of Service or Acceptable Use Policy that would prohibit the specific testing necessary under this policy, to the extent that testing complies with the rules below.
    • If a third party brings legal action against you for activity that complied with this policy, we will make clear that your actions were authorized.

    This authorization does not extend to data you do not need, to systems out of scope, or to actions that violate the rules in Section 5 or applicable law.

    5. Rules of Engagement

    You must:

    • Only test accounts you own or have explicit permission to test. Create test accounts rather than using real customer data.
    • Stop immediately if you access another party's personal data, payment data, or identity documents, and report it without copying, retaining, or disclosing that data.
    • Avoid privacy violations, data destruction, and service degradation. Do not run DoS, brute-force, or spam tests.
    • Not exfiltrate data beyond the minimum needed to prove a vulnerability.
    • Not use social engineering, phishing, or physical intrusion.
    • Keep details confidential until we confirm the issue is resolved (Section 7).

    6. Recognition

    We do not currently operate a paid bug-bounty program. With your permission, we are glad to credit researchers who responsibly disclose valid, in-scope vulnerabilities in a security acknowledgements list. We will discuss recognition with you during triage.

    7. Coordinated Disclosure

    Please give us a reasonable time to remediate before any public disclosure. Our default coordinated-disclosure window is 90 days from your report, or sooner once a fix is deployed. We are happy to coordinate timing and a joint advisory with you. If a vulnerability is being actively exploited, we may ask for additional time and will keep you informed.

    8. Examples of Lower-Priority / Excluded Findings

    The following are usually not treated as actionable on their own, absent a demonstrated exploit:

    • Missing "best practice" HTTP headers without a concrete impact
    • Clickjacking on pages with no sensitive state-changing action
    • Self-XSS that cannot be used against another user
    • Reports from automated tools without validation
    • Rate-limiting issues without security impact
    • Email spoofing on domains without sending mail, or missing SPF/DKIM/DMARC without a working exploit
    • Issues affecting only outdated or end-of-life browsers

    9. Contact

    This Vulnerability Disclosure Policy is part of RentalTide's legal center. Reporting a vulnerability does not grant any other right to access RentalTide systems or data outside the terms of this policy.