RESPONSIBLE DISCLOSURE POLICY

The security of Booksy systems and data residing within them is crucial for us, and we treat potential security issues with a top priority. We do our best to protect the data of Booksy merchants and customers from security threats, and we encourage all users and security researchers to report security vulnerabilities discovered in our platform. Reports should be submitted through Intigriti, which will handle the first line of triage.

We are committed to handle vulnerability reports in a timely manner and the greatest attention, provided that the following Policy is respected.

I. SCOPE

1. Booksy’s vulnerability disclosure program covers the following products:
   1. Booksy Customer Application - https://booksy.com/
   2. Booksy Business Application - https://booksy.com/pro/
   3. Booksy Mobile Applications:
      • Booksy for Customers (Android, iOS)
      • Booksy Biz: For Businesses (Android, iOS)
2. While Booksy develops a number of other products, we ask that all security researchers submit vulnerability reports only for the stated product list from point 1 above, subject to point 3 below.
3. If you believe that you identified a critical risk vulnerability or potential data leakage which is not in scope from point 1 above, but still may negatively impact data of Booksy or its users, please do not hesitate to get in contact with us.

II. REPORTING AN ISSUE

1. All the reports should be submitted through Intigriti via our dedicated VDP program there: https://app.intigriti.com/researcher/programs/booksy/booksyvdp
2. When reporting, make sure to follow all the requirements from Intigriti. Include all details, steps for reproduction, affected assets and impact.

III. VULNERABILITY DISCLOSURE PROCEDURE

1. You privately share the details of the security vulnerability with Intigriti and Security Team by reporting an issue, as described in point II (1) above.
2. We acknowledge your submission and verify the vulnerability. In line with provided timelines on the VDP program page. Additional details might be required.
3. Once a vulnerability is patched by our product team we notify you about the fix. For impactful vulnerabilities, some highs and criticals, we might add you to our Hall Of Fame, if you agree to.

IV. RULES OF ENGAGEMENT

1. Detailed rules can be found on the Intigiti page. Here is a short version:
   1. do not store Booksy’s non-public data (except the data necessary to document and report the presence of a potential vulnerability);
   2. do not attempt to access or modify data that belongs to other Booksy user;
   3. do not attempt to execute denial of service attacks, or to compromise the reliability and availability of Booksy services;
   4. do not use scanners, automated tools or any other tools which may generate excessive traffic and negatively impact system’s availability;
   5. never attempt non-technical attacks such as social engineering, phishing, or physical attacks against anyone or any system;
   6. do not publicly disclose vulnerabilities without our prior consent (disclose only according to the disclosure procedure in point IV above).

V. WHAT TO REPORT

1. In scope and out of scope vulnerabilities list is present on Intigtiti's page.

VII. HALL OF FAME

We would like to thank the following individuals for their contribution to increasing the overall Booksy’s security posture.

2022

1. Takshal Patel
2. Mubassir Patel
3. Nikhil Rane
4. Shivansh Khari
5. Sam Crowther
6. Opinder Singh

2023

1. Mohamed Shibil
2. Robert Muchacki

2025

1. Gr3yG05T
2. Harshvardhan Kumavat