Security and Responsible Vulnerability Disclosure Policy

RYDZ welcomes responsible reports of security weaknesses affecting our publicly accessible ride, ticket, payment and account systems. Send a confidential report to support@rydzmw.com with subject SECURITY — Responsible Disclosure, and it will be routed to the people responsible for RYDZ security. This is not a standing offer of a paid bug bounty, permission to conduct intrusive testing or a promise of legal immunity; a safe-harbor program requires separately approved written terms.

Account takeover paths, improper access to another person's booking, ticket QR reuse, payment-reference mix-ups, authorization bypass, sensitive document exposure, unsafe API behavior, GPS tracking leaks, secrets exposed in client applications and payment/webhook replay vulnerabilities are issues we want to understand. A report should describe the affected URL/app version, observed impact, reproducible steps that do not endanger users, and suggested remediation if available.

Do not access, modify, download or publish other people's data except the minimum technically necessary to establish a concern with your own account or explicit permission. Do not run service-disruption tests, brute force, phishing, social engineering, exploit delivery, real-money fraud, vehicle interference, ticket theft or spam. Do not compromise a third-party payment provider or transportation partner. Stop testing and report promptly if you unexpectedly encounter personal information or an active incident.

RYDZ will acknowledge the submission, triage affected systems, preserve evidence securely, prioritize risk, assess whether a data breach occurred and provide updates as practicable. We may ask for additional evidence but not for reckless exploitation. After remediation and when disclosure is safe, we can coordinate timing and appropriate public credit with the reporter. Reports may trigger statutory breach-notification duties independently of this policy.

We retain report information only as necessary to investigate, fix and document security issues, and will not publicly identify a reporter without authorization except where law requires it. Reporting does not transfer the researcher's copyrights or waive users' rights. RYDZ may take protective measures in response to harmful activity, while distinguishing responsible reports from deliberate abuse.