Vulnerability reporting.

01Our commitment

Merchants trust our apps with their stores. If you find a weakness, we want to hear about it, fix it quickly and thank you for it. This policy explains how to report a vulnerability to eBazoo Technologies, and how we’ll work with you.

02What’s in scope

In scope:

• Our Shopify apps: Mobile App Builder, Pick List, Pickup Label and SEO 404 Redirect. That includes their screens in Shopify admin, their servers and APIs, their webhooks and SEO 404 Redirect’s storefront tracker.
• Mobile App Builder’s APIs: the storefront API that merchants’ mobile apps use, and the endpoint for AI tools (MCP).
• Mobile apps built with Mobile App Builder: the eBazoo code in them, tested with an app for a store you own.
• Our websites: ebazoo.com and its subdomains, and help.ebazoo.com.
• eBazoo Backend (central.ebazoo.net): only issues you can find without signing in. Don’t try to guess or reuse passwords.

Out of scope, so please report these to their owners instead:

• Shopify itself: report to Shopify’s bug bounty programme.
• Apple, Google, Cloudflare and the other companies on our sub-processors page.
• Merchants’ own stores, themes and apps from other developers.

03What isn’t a vulnerability for us

These don’t usually put anyone’s data at risk on their own. Report them if you can show real impact:

• missing security headers, cookie flags or email settings (SPF, DKIM, DMARC);
• clickjacking on pages with no sensitive action;
• self-XSS, or attacks that need a compromised device or browser;
• rate limits on actions with no security impact;
• software versions or banners, without a working exploit;
• reports from automated scanners that you haven’t confirmed.

04How to report

Email hello@ebazoo.com with “Security” in the subject. Please include:

1. what you found and where: the app or site, the page or endpoint;
2. the steps to reproduce it, with the requests or screenshots that show it;
3. what an attacker could do with it;
4. the development store and accounts you used;
5. whether you’d like to be thanked by name, and how.

Don’t include other people’s personal data in your report. If you came across some, say so, and we’ll take it from there.

05The rules

• Test only on a development store you own, with accounts you own.
• Stop as soon as you reach anyone else’s data. Don’t copy, keep, change or share it, and tell us.
• Use only what you need to show the issue. Don’t pivot to other systems or keep access.
• No denial-of-service, load or volume testing, and no spam.
• No phishing, social engineering or physical attempts on our team, our partners or merchants.
• Keep the details private until we’ve fixed the issue, or for 90 days after your report, whichever comes first. If we need longer, we’ll explain why and agree a date with you.

06What we promise

• We confirm we’ve received your report within 3 business days.
• We investigate, tell you what we found, and keep you posted while we fix it.
• We tell you when it’s fixed, so you can check.
• We treat your report and your details as confidential.
• If the issue affected merchants’ data, we tell them, as our Data Processing Agreement requires.

07Safe harbour

If you research and report in good faith and follow this policy:

• we consider your research authorised, and won’t take or support legal action against you for it;
• if someone else takes action against you for it, we’ll make clear that you acted under this policy.

This covers eBazoo’s systems only. It can’t authorise testing of Shopify, our sub-processors or anyone else’s systems.

08Recognition

We don’t run a paid bug bounty yet. With your permission, we thank everyone who reports a valid issue by name, and we’ll say here if we start a reward programme.

09Contact us

Security reports and questions: hello@ebazoo.com. Our Security page explains how we protect store data.

eBazoo Technologies · Lahore, Pakistan