Security

Email security@tastbudz.com. Plain email is fine; we do not publish an encryption key. Tell us the URL or endpoint involved, the steps to reproduce what you saw, and what it let you do that it should not have. A request and its response, or a screenshot, is worth more than a scanner's summary.

We read everything sent to that address. We reply to reports that describe a reproducible issue, and we will tell you when it is fixed if you ask us to.

• Test only with accounts you created yourself.
• Do not read, change or delete anyone else's data. If an issue would let you, stop at the point where you have shown that it exists, and report it.
• No denial of service, no automated flooding, and no social engineering of us or of the restaurants listed here.
• Give us a reasonable amount of time to fix an issue before you publish it.

Tastbudz does not run a bug bounty program and does not pay for security reports, including reports that turn out to be valid. Please do not ask; the answer is the same for everyone. If you would like to be credited for an issue once it is fixed, say so in your report.

These are the findings automated scanners produce for every site on the internet. Sending them is not a security report, and they will not get a reply.

• Scanner output with no demonstrated impact on Tastbudz or the people who use it.
• Opinions about our DNS or email records (SPF, DMARC, DKIM, CAA) without a working abuse case.
• Missing or "best practice" headers on responses that carry no user data, and version or technology disclosure.
• The sign-in page for staff routes being reachable. It is a login prompt; the interfaces behind it require a staff session and answer 401 without one.
• Rate limiting, password policy and similar hygiene notes.
• Issues in the third-party services we build on (Google sign-in, Cloudflare Turnstile, Amazon Web Services), which belong with those providers.

We treat security research carried out within the rules above as authorised, and we will not pursue or support legal action against you for it. That covers the testing itself; it does not cover anything that goes past the point of demonstrating an issue.

Tastbudz LLC — security@tastbudz.com. This page is the policy that /.well-known/security.txt points to. Questions about your own data go to the address in the Privacy Policy, not this one.