Security

1. How to report

Email security@partsmeet.com. Please do not post the details publicly, in a review, or in a message to another user until we have fixed the problem.

For a problem with your own account, such as a sign-in you do not recognize or an order you did not place, email us too. We will lock things down first and investigate after.

2. What to include

• the page or address where you found it,
• the steps to see it happen again,
• what you think someone could do with it, and
• any account IDs, order numbers or listing links that you used while testing.

3. Testing rules

• Only test with accounts you own. Never view, change or delete another person's data.
• If you reach someone else's data by accident, stop, do not keep a copy, and tell us.
• Do not place real orders you do not intend to pay for, and do not message other users as part of a test.
• No denial of service, load testing, spam, phishing or social engineering of our team or our users.
• Give us a reasonable time to fix a problem before you talk about it publicly.

4. Out of scope

These are not security problems on their own, so we will not treat them as one:

• reports from automated scanners with no working example,
• missing best-practice headers that cannot be used against anyone,
• problems that need a stolen device, a hacked browser or a phone that is already unlocked, and
• issues in services we use, such as Stripe or our shipping carriers. Please report those to them.

5. Good-faith research

If you follow the rules on this page, we will not take legal action against you or ask anyone else to, and we will treat your report as helpful. We do not run a paid bug bounty right now. With your permission, we are happy to thank you by name once the fix is live.

6. How quickly we respond

We will reply within 5 business days to confirm we have your report, and we will keep you updated until it is fixed. Our machine-readable contact file is at /.well-known/security.txt.