Responsible Disclosure Policy

We welcome good-faith security research that helps protect our users and infrastructure. If you follow this policy, we will make a good-faith effort to respond promptly, keep you informed of progress where practical, and will not pursue legal action related to your research, provided your activities remain within the guidelines below and applicable law.

Please email security findings to security@ippomart.com. Include enough detail for our team to reproduce and validate the issue.

• A clear description of the vulnerability and potential impact
• Steps to reproduce (URLs, endpoints, request/response samples where relevant)
• Proof of concept (screenshots, video, or code snippets) without exploiting beyond demonstration
• Affected product or service (website, app, partner tools, or infrastructure)
• Your preferred contact details and whether you wish to be acknowledged publicly

When researching and reporting, please:

• Act in good faith and comply with applicable laws
• Use test accounts where possible and avoid accessing real customer or partner data
• Stop testing immediately if you encounter personal or sensitive data, and report what you found
• Give IppoMart a reasonable time to investigate and remediate before any public disclosure
• Do not publicly disclose vulnerability details without our written permission

The following activities are not permitted under this policy:

• Exploiting a vulnerability beyond what is needed to demonstrate the issue
• Accessing, copying, modifying, or deleting data that does not belong to you
• Performing denial-of-service (DoS/DDoS), spam, or social-engineering attacks
• Physical attacks on offices, warehouses, partner stores, or delivery partners
• Sending reports generated solely by automated scanners without manual validation
• Violating privacy, disrupting services, or impairing system availability for other users

In-scope assets generally include IppoMart-operated services that create a meaningful security or privacy risk for our users or infrastructure.

• www and marketing website domains operated by IppoMart
• IppoMart mobile applications (when available) for customers, stores, and delivery partners
• APIs and backend services owned and operated by IppoMart
• Authentication, authorization, and account-security issues

Any reproducible design or implementation issue that substantially affects the security of IppoMart users is likely in scope. Common examples include:

• Remote code execution or significant injection flaws
• Cross-site scripting (XSS), CSRF, or authentication bypass
• Insecure direct object references leading to unauthorized data access
• Privilege escalation or account takeover
• Sensitive data exposure due to misconfiguration
• Domain takeover of IppoMart-owned infrastructure

The following are generally out of scope or unlikely to qualify for recognition:

• Issues without clear security impact (UI bugs, typos, missing best-practice headers alone)
• Reports from automated tools without demonstrated impact
• Denial-of-service or rate-limiting issues without a concrete, high-impact exploit path
• Clickjacking on pages without sensitive actions
• Self-XSS requiring unlikely user interaction
• Vulnerabilities in third-party services outside IppoMart’s control
• Physical security, phishing of IppoMart staff, or social engineering

We recognise security researchers who help keep users safe. Recognition is entirely at IppoMart’s discretion based on risk, impact, ease of exploitation, and report quality. There is currently no cash bounty program. Extremely low-risk findings may not qualify for public acknowledgement.

• Be the first person to responsibly disclose a valid issue
• Report a bug that could compromise private data, circumvent protections, or enable unauthorized access
• Adhere to this Responsible Disclosure Policy
• Provide a clear, actionable report within the defined Scope

We may update this policy from time to time. The “Last updated” date on this page reflects the latest revision. Continued research against IppoMart services after updates constitutes acceptance of the revised policy.

For security reports and questions about this policy:

Email: security@ippomart.com

IppoMart — Fast. Reliable. Near You.