Security & Vulnerability Disclosure

Please contact us right away if you have found any security weaknesses on GardenMora.com.

All valid reports will be taken seriously and we will work to fix any verified issues as soon as possible.

Prior to submitting your report you need to read through the following guidelines which include our main principles together with bounty program requirements and non-qualifying issues.

SECTION 1 – CORE PRINCIPLES

GardenMora will not pursue legal action or an investigation against you if you submit vulnerability reports according to the guidelines below.

We ask that you:

1. Allow Reasonable Time
Give us enough time to investigate the issue and fix it before you share the report with the public.

2. Respect User Privacy
You must not touch or retrieve any personal data from other users' accounts unless they give you their consent.

3. Act in Good Faith
Do not cause privacy violations, service interruptions, data destruction or disruption to others.

4. Do Not Exploit the Vulnerability
Do not use or demonstrate the bug to access sensitive data or escalate risk.

5. Follow Applicable Laws
You should not perform any actions that go against any laws or regulations.

SECTION 2 – BOUNTY PROGRAM

GardenMora appreciates the efforts of ethical curiosity researchers. We compensate monetary rewards to security researchers for reporting valid and relevant vulnerability disclosures. Rewards are paid in our sole discretion based on severity, potential risk, and other factors.

To qualify for a bounty, you must:

1. Comply With Our Core Principles
Outlined in Section 1.

2. Report a Valid Security Bug
The issue must pose a real security or privacy risk to our systems or users (Note: not all bugs qualify).

3. Submit Your Report via Our Security Center
Do not reach out to individual employees directly.

4. Report Responsibly
If you accidentally access data or cause service disruption, report immediately without attempting to explore further.