Responsible Disclosure Policy

1. Overview

We welcome good-faith reports of security vulnerabilities in HighwayTMS. This policy explains what you may test, what you must not do, and how we will respond. It is separate from the Security & Data Protection page, which describes our safeguards.

2. In Scope

• The HighwayTMS web application and its public pages, at https://highwaytms.com;
• The application’s API routes; and
• The Supabase-backed surfaces the application exposes: authentication, database access rules (Row Level Security), and file storage access.

The most valuable reports show a way to read or change another company’s data, escalate a role, or bypass authentication.

3. Out of Scope

• Denial-of-service or load testing, and volumetric or automated scanning that degrades the Service;
• Social engineering, phishing, or physical attacks against our people, customers, or providers;
• Vulnerabilities in third-party services we use (report those to the vendor), including Supabase, Vercel, Stripe, and Google;
• Reports without a demonstrable security impact, such as missing best-practice headers with no exploit, or software version banners; and
• Testing that involves other customers’ real data.

4. Rules of Engagement

• Use only accounts and data you own or create. Do not access, modify, or keep data that belongs to others; stop and report as soon as you can see it.
• Do not exfiltrate data. Use the minimum proof needed, such as a record count or a redacted screenshot.
• Do not degrade the Service or other customers’ use of it.
• Keep the details confidential until the coordinated disclosure window below has ended.

5. Safe Harbor

If you follow this policy in good faith, we will not pursue legal action against you for your research, we will treat it as authorized under our Acceptable Use Policy, and we will not ask a provider to act against you. This does not cover activity that breaks the rules above or the law, and it does not bind third parties. [REQUIRES LEGAL REVIEW.]

6. How to Report

Email support@highwaytms.com with a description, steps to reproduce, the affected URL or component, and the impact you observed. Contact details are also published in our security.txt file.

7. What to Expect

• We aim to acknowledge your report within [ACKNOWLEDGEMENT TIME, e.g. 3 business days].
• We aim to give an initial assessment within [ASSESSMENT TIME, e.g. 10 business days] and keep you informed.
• We fix valid issues based on severity and tell you when they are fixed.

We ask for a coordinated disclosure window of [DISCLOSURE WINDOW, e.g. 90 days] from your report, or until we ship a fix if sooner, before you publish details. If we need more time we will say why.

8. Rewards

We do not run a bug bounty and do not offer monetary rewards. With your permission we are glad to credit you for a valid report.