If you think you have found a security problem in PaddockPath, please tell us. This page says how to report it, what we ask of you while you look into it, and what you can expect from us. PaddockPath is run by Quinence Australia Pty Ltd, in Sydney.
1. How to Report
Email security@paddockpath.com . It reaches two people on our team.
Please include:
- what you found, and where: the web address, app version or API endpoint
- the steps that reproduce it
- what you think someone could do with it
- how to reach you, and whether you would like to be credited
Plain text is fine. If you came across another person's or another company's data, tell us what kind of data it was and where you saw it, but don't send us a copy.
We don't pay for reports.
2. What Is Covered
This policy covers the systems we run:
- our website, paddockpath.com
- our web apps, including feedlot.paddockpath.com and producer.paddockpath.com
- shared report links, our APIs and any other paddockpath.com address we operate
- our AI connector at pp-feedlot-mcp.vercel.app, and any other service we run at an address outside paddockpath.com
- the PaddockPath Feedlot app for iPhone and iPad
It doesn't cover status.paddockpath.com, which Better Stack hosts, or the platforms of the providers we build on, such as Supabase, Vercel, Cloudflare, PowerSync and Postmark. Please report problems in those platforms to the provider. If one of them exposes PaddockPath data, we would still like to hear about it.
3. What We Ask
While you investigate:
- Look at no more data than you need to show the problem. If you find you can see another person's or another company's data, stop there, don't keep or share it, and tell us.
- Don't change or delete data that isn't yours.
- Don't run denial-of-service or load tests, or anything else that slows the service down for the feedlots using it.
- Keep automated scanning to a rate that doesn't disrupt the service.
- Don't try phishing or other social engineering on our team or our customers, and don't try to get physical access to their offices, yards or devices.
- Give us time to fix the problem before you publish anything about it. We ask for 90 days from your report, or less once we have told you it is fixed.
- Don't ask for payment in return for the details.
4. Safe Harbour
If you make a good-faith effort to follow this policy, we consider your research authorised by us. We won't take legal action against you for it, and we won't ask law enforcement to act against you because of it. If someone else takes legal action against you over research that followed this policy, we will make it known that we authorised it.
We can only authorise research on systems we run. If you are unsure whether something is allowed, ask us at security@paddockpath.com before you try it.
5. What You Can Expect From Us
- We will acknowledge your report within 3 business days, counted in Sydney.
- Within 10 business days we will tell you whether we could reproduce the problem and how serious we think it is.
- While we work on a fix, we will update you at least once a month, and we will tell you when it is fixed.
- If you would like to be credited, we will name you once the fix is out.
6. Contact
Security reports: security@paddockpath.com
Our security.txt file is at https://www.paddockpath.com/.well-known/security.txt.
Everything else: hello@paddockpath.com