Security Policy

Last updated: Oct 23, 2026

At Peddle, we take the security of our systems and the protection of our customers’ data seriously. We welcome reports from security researchers and members of the public who identify potential vulnerabilities in our services, and we are committed to working with you to verify, resolve, and, where appropriate, reward valid findings. This page describes what we consider in scope, how to report an issue, how we assess severity, and how rewards are determined.

The quickest way to reach our security team is by email at cybersecurity@peddle.com. A machine-readable summary of this policy is published at /.well-known/security.txt.

Scope

At this time we are primarily interested in Critical and High severity issues affecting Peddle’s production services and the data they hold. Lower-severity reports are still welcome and will be reviewed.

When investigating a potential vulnerability, please observe the following boundaries:

Do not perform testing that degrades, disrupts, or denies access to our production services or their users. This includes denial-of-service (DoS) testing, load or stress testing, and automated attacks against live accounts.
Do not access, modify, store, or delete data that does not belong to you. Use test accounts you control wherever possible.
Do not exploit findings. Please limit your activity to what is strictly necessary to demonstrate the issue, and stop as soon as you have confirmed it.
Do not use social engineering, phishing, or physical attacks against Peddle employees, contractors, or facilities.

Severity and CVSS scoring

Peddle uses the Common Vulnerability Scoring System version 4.0 (CVSS v4.0), published by FIRST (the Forum of Incident Response and Security Teams), as the standard for assessing and communicating the severity of reported vulnerabilities. CVSS provides a consistent, transparent way to describe a vulnerability’s characteristics and derive a severity score from 0.0 to 10.0.

When you submit a report, please include a CVSS v4.0 Base score and the corresponding vector string (for example, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) where applicable. You can generate both using the official FIRST calculator at https://www.first.org/cvss/calculator/4.0. Reports without a CVSS score are still accepted and will be scored by Peddle. If you provide a CVSS v3.1 vector instead, we will re-score the issue in CVSS v4.0.

Peddle’s security team will review the submitted vector, validate each metric against the confirmed behavior and impact of the issue in our environment, and determine the final CVSS score and severity. Peddle’s final score may incorporate CVSS v4.0 Threat and Environmental metrics (CVSS-BTE) to reflect the issue as it exists in our environment. Where our assessment differs from yours, we will explain the reasoning.

Rewards

We assess each valid report based on its impact and assign one of the severity tiers below. The reward range for each tier is shown in the list that follows, and reward ranges are guidelines.

Critical (CVSS 9.0-10.0): USD 1,000-3,000+
High (CVSS 7.0-8.9): USD 300-900
Medium (CVSS 4.0-6.9): USD 200-300
Low (CVSS 0.1-3.9): USD 100 or Peddle-branded merchandise

Reward amounts are confirmed with the reporter in writing before any payment is made, and payment is issued once a reward agreement is signed. Only the first reporter of a previously unknown, valid issue is eligible for a reward. We reserve the right to determine the final CVSS score, severity, and eligibility at our discretion.

How to report

Please email your report to cybersecurity@peddle.com with enough detail for us to understand and confirm the issue. A good report includes:

What you found and where (for example, the affected URL, endpoint, or page).
The impact (what an attacker could do with the issue).
Clear, step-by-step instructions to reproduce it.
Supporting evidence, such as a short write-up, a screenshot, or an example request.
Your proposed CVSS v4.0 Base score and vector string, where applicable (see Severity and CVSS scoring above).

We will acknowledge your report within 48 hours and give you an estimated timeline for resolution. Please give us a reasonable amount of time to investigate and remediate before disclosing an issue publicly.

Handling of data

Once you have submitted your report, please securely delete any Peddle data you accessed or copied during testing from your systems. Do not retain, share, or publish Peddle data obtained through your research.

Safe harbor

We consider security research conducted in good faith and in accordance with this policy to be authorized. We will not pursue or support legal action against researchers who make a good-faith effort to comply with this policy. If legal action is initiated by a third party against you for activity that was conducted in accordance with this policy, we will make this authorization known. If you are ever unsure whether specific testing is consistent with this policy, contact us at cybersecurity@peddle.com before proceeding.