Every vehicle. One marketplace.
In short: security researchers make the internet safer, and we want to hear from you. Here is how to report a problem and what we promise in return.
Last updated . Written by the AutoOnes team.
- We reply within
- Good-faith research
- Credit
- Scope
- Email us. Send your report to [email protected] with SECURITY in the subject.
- What to include. What you found, where it is, the steps to reproduce it and the impact as you see it.
- Any format. Encrypted or plain, clear matters more than format.
- We investigate. Every credible report is looked into, and we keep you updated.
- No legal action. Good-faith research under this policy will not be met with legal action.
- Fast fixes. We fix confirmed serious issues quickly, and credit you publicly if you want.
- We do not go quiet. You hear from us when we receive it, when we assess it and when it is fixed.
- Your own accounts only. Do not access, change or copy other users' data. Test on your own accounts.
- No disruption. No denial of service, spam floods or tricking our team.
- Time to fix. Give us reasonable time to fix a problem before telling anyone else.
- Gentle scanning. Automated scanning that slows the service down for users is not allowed.
- In scope. autoones.com and its subdomains, our APIs, including the public fuel prices API, and any official apps.Fuel prices API →
- Out of scope. Other companies' services we use, like payment processors and email providers. Report their issues to them.
- The basics, done properly. Encrypted connections, locked passwords, security emails and limited team access.Trust and safety →
How do I report a security problem on AutoOnes?
Email [email protected] with SECURITY in the subject and the details of what you found. We reply within 72 hours.
Will you take legal action against me?
Not for good-faith research that follows the ground rules on this page.
Do you pay bug bounties?
We do not run a paid bug bounty at the moment. We credit researchers publicly if they want.
Found something? Open a support ticket or email [email protected]. A person replies.