Vulnerability disclosure program

Scope

www.wheewise.com, dealer.wheewise.com, and association.wheewise.com. Third-party services we rely on (Supabase, Cloudflare, Google, WhatsApp, etc.) are out of scope — please report issues in those directly to their own security teams.

How to report

Email [email protected] with a description of the issue, steps to reproduce it, and its potential impact. Please don't include real user data or account credentials that aren't your own in your report.

Guidelines

• Only test against accounts and data you own or have explicit permission to use.
• Don't run automated scans or load tests that could degrade the service for other users.
• Don't attempt social engineering against our team, dealers, or users.
• Don't access, modify, or delete data that isn't yours.
• Give us a reasonable amount of time to fix an issue before disclosing it publicly.

What to expect from us

We'll acknowledge your report within a few business days and keep you updated as we investigate and fix the issue. We don't currently run a paid bug bounty program, but we're happy to credit researchers who report a valid issue in good faith, if you'd like.

Safe harbor

We won't pursue legal action against anyone who reports a vulnerability in good faith and in line with these guidelines.