We want PetHour to be safe for the people and pets who use it. If you find a security weakness in PetHour, we want to hear about it. This policy says what you may test, how to test it, how to report what you find, what we do with your report, and the legal safe harbor we give good-faith research. The PetHour™ platform is operated by ITPro Solutions LLC (“PetHour”, “we”, “us”).
In scope: our website at pethour.app and www.pethour.app, our API at api.pethour.app, and the PetHour apps for iOS and Android.
Out of scope:
our test environment (test.pethour.app and testapi.pethour.app) — it shares some live services, so testing it can reach real people;
services our providers run, such as Stripe, Twilio, Google, Apple, and Checkr — please report those to the provider under its own program;
social engineering or phishing of members or staff, physical attacks, denial-of-service or load testing, and spam.
We do not usually treat these as vulnerabilities on their own: missing security headers or cookie flags with no demonstrated impact, clickjacking on pages with no sensitive action, self-XSS, software version disclosure, rate limits on non-sensitive actions, and automated scanner output without a working proof of concept.
Use only accounts you create and own. Do not access, change, or delete anyone else’s data, and use no more data than you need to show the problem.
If you reach another person’s personal data, stop, do not keep or share it, and tell us straight away.
Do not make real bookings, payments, gift purchases, payouts, or background checks with or against other members, and do not verify an identity with documents that are not your own.
Do not message, call, or text other members, and do not send email or text messages in bulk.
No denial of service, no scanning that degrades the service for others, and no malware.
When you finish, delete any data you obtained, and keep the details private until the problem is fixed (see Coordinated Disclosure below).
Use our Contact form and choose “Security report”, or email support@pethour.app with the subject “Security report”. You do not need a PetHour account. Please include:
what you found and where — the address, endpoint, or app screen;
the steps to reproduce it, with any proof of concept;
what an attacker could do with it; and
how to reach you, and the name or handle to credit if you would like credit.
Please do not put another member’s personal data in your report — describe it instead.
Please give us a reasonable time to fix a problem before you tell anyone else about it: 90 days from your report, or until the fix is released if that is sooner. If we need longer, we will explain why and agree a date with you. If a problem is being actively exploited, we may tell affected users sooner ourselves.
If you make a good-faith effort to follow this policy:
we consider your research authorized, including under the Computer Fraud and Abuse Act and similar state laws, and we will not bring a legal claim against you or ask law enforcement to act against you for it;
we waive the rules in our Terms of Service that would otherwise restrict that research — for example the rules on scraping, reverse-engineering, and tampering in Terms of Service, Section 18 — for the research you do under this policy, and nothing else;
we will not bring a claim under the Digital Millennium Copyright Act for getting around a technical measure in the course of that research; and
if someone else takes legal action against you over research you did under this policy, we will make it known that your research was authorized.
This safe harbor covers PetHour’s own claims; it cannot bind other members or our providers. If you are not sure whether something is allowed, ask us first through the Contact form.
Security reports: our Contact form (“Security report”), or support@pethour.app with the subject “Security report”. This policy is also listed in our security.txt file.
By mail: ITPro Solutions LLC, 1639 Sunstone Dr, Tysons, VA 22102, United States.