Security Policy

1. Purpose

We work to protect the getyourtrip.asia website, the Get Your Trip mobile app and our users' data. If you discover a vulnerability, please report it as described in this policy.

2. Scope

This policy covers the getyourtrip.asia website, the Get Your Trip mobile app and the API they use. Third-party services — payment providers, messengers, social networks, hosting, operators' websites — follow their own rules; please report issues in them to their owners.

3. How to report a vulnerability

Email admin@getyourtrip.asia with “Security” in the subject line. Please include:

• a description of the issue and its potential impact;
• the affected URL, app section or API method;
• steps to reproduce;
• where helpful, screenshots, requests and responses demonstrating the issue;
• a contact for follow-up.

Do not send passwords, full payment card details or other people's personal data.

4. Testing rules

When looking for and verifying vulnerabilities:

• do not perform destructive testing: do not delete or modify other people's data, disrupt the website or app, run load attacks or mass automated scanning;
• do not access other users' personal data, accounts, bookings or messages; if you gain such access accidentally, stop, do not keep or share the data, and let us know;
• use only your own accounts and test data;
• do not use social engineering, phishing or physical actions against our staff, operators or users;
• do not disclose information about the vulnerability publicly or to third parties until agreed with us.

5. How we handle reports

We review every report, ask for more information where needed and let you know the outcome. Review time depends on the complexity of the issue; we do not commit to fixed response times.

6. Rewards

We do not run a bug bounty program. We appreciate good-faith reports but do not pay rewards for them.

7. Machine-readable contact

The reporting contact is also published at /.well-known/security.txt.