1. Introduction
PreStartGo takes the security of our platform seriously. We value the contribution of security researchers and welcome responsible disclosure of vulnerabilities. This policy explains how to report an issue, what is in scope, and the commitments we make in return.
2. Reporting a Vulnerability
Email security@prestartgo.com. Include:
- A clear description of the issue and its impact.
- Steps to reproduce (proof of concept, screenshots, scripts).
- The affected URL, endpoint, or asset.
- Your name or handle so we can credit you if desired.
Encrypted submissions are welcome — a PGP key is available on request. We acknowledge receipt within two business days.
3. Scope
The following assets are in scope:
- prestartgo.com and all subdomains (www, admin, api, site, trust, status, mobile, staging, dev).
- PreStartGo mobile applications published on the Apple App Store and Google Play Store.
- PreStartGo hardware devices (the Interlock) — firmware and BLE interfaces.
4. Out of Scope
- Denial of service (volumetric, SYN flood, etc.) and resource exhaustion attacks.
- Social engineering of PreStartGo staff, customers, or suppliers.
- Physical attacks against PreStartGo offices, data centres, or personnel.
- Reports of missing best-practice headers without a demonstrable security impact (e.g., missing
X-Content-Type-Optionson a static asset). - Automated scanner output without validation or proof of exploitability.
- Self-XSS requiring the victim to paste malicious content into their own browser console.
5. Safe Harbor
PreStartGo will not pursue legal action against researchers who:
- Make a good-faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services.
- Report vulnerabilities to us promptly via security@prestartgo.com and give us reasonable time to remediate before public disclosure.
- Do not exploit, access, or exfiltrate production user data.
- Comply with all applicable laws.
Activities conducted in accordance with this policy are considered authorised. If legal action is initiated by a third party against you for activities performed in good-faith compliance with this policy, we will make this authorisation known.
6. Response Commitments
- Acknowledgement within two business days of receipt.
- Initial triage within five business days, including severity classification and an indicative timeline.
- Status updates at least every ten business days until the issue is resolved.
- Public credit (optional, with your permission) on the PreStartGo security page once the issue is remediated.
7. What We Ask
- Give us a reasonable opportunity to remediate before public disclosure. Our target is 90 days, or sooner if the issue is already being exploited.
- Do not intentionally access data belonging to other customers. If you encounter personal data, stop, report it, and delete any copies you may have retained.
- Do not use findings for commercial gain beyond any bug-bounty reward offered by us.
8. Contact
Security issues: security@prestartgo.com
RFC 9116: /.well-known/security.txt