Responsible Disclosure Policy
Bookwhen’s top priority is to keep customer data safe and secure. To ensure that we continue to work toward the best possible security for Bookwhen, we invite responsible disclosure of any security vulnerability you may find. We ask that you do not share this publicly. Instead, please email us.
We ask that you find and report vulnerabilities responsibly, with the following principles in mind:
- You must not break any applicable law or regulations.
- Do not access or modify, or attempt to access or modify, or expose any data that does not belong to you; only test on your own account.
- If you do access personal data belonging to someone else, stop straight away. Do not save, copy, transfer or otherwise use it, tell us immediately, and delete it once you have reported it to us.
- Do not execute, or attempt to execute, a Denial of Service (DoS) attack.
- Do not run any automated tools against our servers without prior coordination.
- Do not exfiltrate data from our infrastructure (including source code, data backups, configuration files).
- If you obtain remote access to our system, report your finding immediately. Do not attempt to pivot to other servers or elevate access.
- Avoid scanning techniques that are likely to cause degradation of service to other customers (e.g. by overloading the site). This includes the spamming of contact forms, support emails, etc.
- Keep within the guidelines of our Terms and Conditions.
- Keep details of vulnerabilities secret until Bookwhen has been notified and had a reasonable amount of time to fix the vulnerability.
Scope
This Disclosure Policy covers the Bookwhen products and services we operate ourselves:
- The Bookwhen website and web application at bookwhen.com, including customer booking pages hosted on bookwhen.com subdomains.
- Our public API at api.bookwhen.com.
- Our booking pages where they are embedded in a customer’s own website.
Third party services that we use but do not operate, for example our payment providers, email delivery and help centre, are not covered by this Disclosure Policy. Please report vulnerabilities in those services to the provider directly.
Within that scope, the following conditions apply:
- “In scope” vulnerabilities must be original, previously unreported, and not already discovered by internal procedures.
- Volumetric vulnerabilities are not in scope; this means that simply overwhelming a service with a high volume of requests is not in scope.
- Reports of non-exploitable vulnerabilities, or reports indicating that our services do not fully align with “best practice” (for example missing security headers) are not in scope.
- TLS configuration weaknesses, for example “weak” cipher suite support or the presence of TLS 1.0 support, are not in scope.
- Functional bugs that do not create a security vulnerability are not in scope. Please report these to our support team at support@bookwhen.com.
- This Disclosure Policy applies to everyone, including Bookwhen staff, third party suppliers and general users of Bookwhen public services.
Reporting and Reproducibility
If you believe you have found a security vulnerability, please submit your report to us on disclosure@bookwhen.com.
In your report please include details of:
- The website, IP or page where the vulnerability can be observed.
- A brief description of the type of vulnerability.
- Steps to reproduce. These should be a benign, non-destructive, proof of concept. This helps to ensure that the report can be triaged quickly and accurately. It also reduces the likelihood of duplicate reports, or malicious exploitation of some vulnerabilities, such as subdomain takeovers.
After reporting an issue, our engineers must be able to replicate and reproduce the flaw that you have identified. If your report is too vague or is not clear, this will result in your finding not being eligible.
Bug Bounty
We value those who take the time and effort to report security vulnerabilities according to this policy. However, at this time, we do not offer a paid bug bounty programme.
What to expect
After you have submitted your report, we will usually respond to your report within 5 working days and aim to triage your report within 10 working days. We’ll also aim to keep you informed of our progress.
Priority for remediation is assessed by looking at the impact, severity and exploit complexity. Vulnerability reports might take some time to triage or address. You are welcome to enquire on the status but should avoid doing so more than once every 14 days. This allows our teams to focus on the remediation.
We will notify you when the reported vulnerability is remediated, and you may be invited to confirm that the solution covers the vulnerability adequately.
Legalities
This Disclosure Policy is designed to be compatible with common vulnerability disclosure good practice. It does not give you permission to act in any manner that is inconsistent with the law, or which might cause your organisation or partner organisations to be in breach of any legal obligations.
Within those limits, if you make a good faith effort to follow this Disclosure Policy while finding and reporting a vulnerability, we will treat your research as authorised. We will work with you to understand and resolve the issue quickly, and we will not bring or support a legal claim against you in connection with your report.
If a third party brings legal action against you in connection with research you carried out in compliance with this Disclosure Policy, we will make it known that your actions were carried out in compliance with it.
If you are unsure whether a particular action is consistent with this Disclosure Policy, please ask us at disclosure@bookwhen.com before you go ahead.
This Disclosure Policy was last updated on 19 August 2026 and this version replaces any other Disclosure Policy previously applicable from this date.