Vulnerability Disclosure

InQueue Limited ("InQueue", "we") takes the security of our queue-management platform seriously. We welcome good-faith reports of security vulnerabilities from researchers and users, and we commit to working with you to understand, validate and remediate them.

1. How to report

Email [email protected] with “SECURITY” in the subject line, a description of the issue, the steps needed to reproduce it, the affected URL or component, and any relevant proof of concept. Please report in English. Our machine-readable policy pointer lives at /.well-known/security.txt (RFC 9116).

2. What to expect from us

Acknowledgement of your report within 3 business days.
An initial assessment and expected remediation timeline within 10 business days.
Notice when the issue is fixed, and credit for the finding if you would like it (we do not currently operate a paid bounty programme).
No legal action for good-faith research that respects the scope rules below. We consider research conducted under this policy to be authorised.

3. Scope and ground rules

Do not access, modify or delete data that is not your own. If a proof of concept exposes another tenant's or person's data, stop and report immediately.
No denial-of-service testing, spam, social engineering, or physical attacks against our staff, infrastructure or customers.
No automated scanning at a volume that degrades the service. Queue displays and kiosks in public venues serve real customers.
Use test accounts wherever possible, and give us reasonable time to remediate before any public disclosure.

4. Out of scope

Findings on third-party services we use but do not operate (payment processors, email providers, CDN), report those to the vendor.
Reports from automated tools without a demonstrated, exploitable impact.
Missing security headers or best-practice flags on pages with no sensitive function, clickjacking on unauthenticated static pages, and version disclosure without a working exploit.

5. Safe harbour

Security research carried out in good faith and in material compliance with this policy will be treated as authorised conduct. We will not initiate or support legal action against you for it, and if a third party does, we will make it known that your activities were conducted under this policy.

6. Contact