Responsible Disclosure Policy

PrepStack Responsible Disclosure Policy

Last updated: 13 October 2026

1. Our commitment

PrepStack welcomes good-faith reports that help us protect people, restaurants, business customers and our services. We will review reports, investigate issues that affect systems we operate, and work with reporters toward a coordinated disclosure.

This Policy explains where and how to report a suspected vulnerability and the safeguards we ask researchers to follow. It is not permission to test systems outside the scope below, access other people's information, or disrupt a service.

2. Scope

The following hostnames appear in current product source or configuration. They are a proposed scope pending verification; this list becomes authoritative only after PrepStack confirms ownership, active production use and approval to include each host.

Only a hostname expressly listed here is in scope. An API endpoint is covered only when it is served from a listed hostname and operated by PrepStack. A wildcard, similar-looking domain, unlisted subdomain, IP address, cloud account, mobile app, or development/staging environment is not included unless PrepStack adds it to this Policy or gives written authorization. The fact that a PrepStack service connects to another system does not bring that system into scope.

Out of scope

Unless the owner separately authorizes the work in writing, do not test:

• Restaurant point-of-sale (POS) systems, restaurant networks, devices, databases or accounts, including systems connected to PrepIQ integrations.
• Payment processors, identity providers, hosting or cloud providers, app stores, analytics vendors, telecommunications providers, or any other third-party service.
• Customer, restaurant, staff, researcher or other people's accounts, devices, data or credentials.
• Any domain, endpoint or infrastructure not expressly listed in the in-scope table.

Testing PrepIQ's own connector or integration code does not authorize testing a restaurant's POS or a POS vendor's service. If you are unsure whether a target is in scope, ask PrepStack through the verified security-reporting channel before testing it.

3. How to report

The live PrepIQ Security page currently directs vulnerability reports to customer@prepiq.net with the subject Security report. This is the only public reporting channel found in our review. Before using it for company-wide reports, PrepStack must confirm that the mailbox is monitored and that its owner is authorized to receive reports about the in-scope systems. Do not send reports to an address guessed from a domain.

Please include, where available:

• A short description of the suspected vulnerability and its potential impact.
• The affected in-scope hostname, page, API or component, and the version or environment if known.
• Clear reproduction steps, including the minimum requests or actions needed to demonstrate the issue.
• A proof of concept that uses your own test account and data and avoids collecting or exposing other people's information.
• Your preferred contact method and any proposed disclosure timeline.

Do not include passwords, access tokens, payment credentials, customer records or unnecessary personal information in a report. If your research unexpectedly exposes such information, stop, do not copy or share it, and tell us only what is needed to locate and protect the affected system.

4. Research guidelines

When investigating an in-scope system, please:

• Act in good faith and use the least intrusive method needed to verify the issue.
• Use accounts and data that you own or are explicitly authorised to use.
• Stop testing as soon as you have enough information to explain the issue.
• Stop and report promptly if you encounter another person's account, private information, restaurant business data, payment information or credentials.
• Keep vulnerability details and any evidence confidential while we investigate and coordinate a disclosure.
• Delete any information you obtained unintentionally, except for the minimum non-sensitive notes needed to describe the report.

Do not:

• Exfiltrate, retain, alter, delete or publish data; create accounts using someone else's identity; or access an account or resource without its owner's permission.
• Perform denial-of-service, resource-exhaustion, destructive, disruptive or high-volume testing, or run scans likely to affect availability.
• Use phishing, social engineering, physical intrusion, malware, persistence, credential stuffing, brute force or attacks against employees or users.
• Test a third-party service, POS system, restaurant environment, integration provider or other out-of-scope target, even if it is linked from or connected to an in-scope PrepStack product.
• Publicly disclose a non-public vulnerability or identifying evidence before coordinating with PrepStack, except where disclosure is required by law.

5. Safe harbor

When you act in good faith, follow this Policy and limit your research to an expressly in-scope system that PrepStack owns or controls, PrepStack intends to treat that activity as authorised to the extent of its own rights and control. PrepStack will not initiate or support legal action against you solely for compliant research under this Policy.

This statement does not authorise conduct prohibited by law, grant permission on behalf of a third party, or prevent a third party from exercising its own rights. It does not protect activity outside the stated scope or activity that violates these guidelines. If you are uncertain whether a proposed test is permitted, do not proceed until PrepStack confirms in writing through the verified security channel.

6. What to expect

We will review reports in good faith, may ask for clarification, and will investigate issues affecting systems we operate. We will share status information when reasonably practicable and coordinate with the reporter on remediation and public disclosure, taking account of user safety and the security impact. We do not promise a particular acknowledgement, remediation or disclosure deadline. A report does not guarantee that PrepStack will accept a finding as a vulnerability or make a particular change.

Please allow us a reasonable opportunity to assess and address a report before publishing technical details. We will not ask for indefinite secrecy; we will work with you to agree on a practical disclosure plan. Do not publish non-public details before the coordinated disclosure date agreed with PrepStack, unless disclosure is required by law.

7. Confidentiality and rewards

We will use report details and supporting evidence to assess, reproduce and remediate the reported issue, protect affected people and systems, and meet legal obligations. Please limit evidence to what is necessary and avoid sending sensitive data. We may retain a report and relevant correspondence for security, audit or legal purposes.

This Policy does not promise a payment, bounty, gift or other reward. Any separate reward program would have its own published eligibility and payment terms. Researchers are responsible for their own costs.

8. Contact and updates

For a suspected security vulnerability, email customer@prepiq.net with the subject Security report, as currently listed on the PrepIQ Security page. Confirm that this channel is monitored for reports about the systems listed in this Policy before publication.

We may update this Policy as our products, systems or disclosure process changes. The “Last updated” date shows the most recent revision. The applicable version is the one published at the time of your research, subject to any written authorisation we give you.

---

Internal publication checks — remove this section before publishing

1. Confirm that customer@prepiq.net is monitored and authorized to receive reports about all included PrepStack, PrepOrder and PrepIQ systems. If it is not, configure and test a suitable reporting channel and update this Policy and security.txt before publication.
2. Verify the hostnames in the proposed scope against the company's domain and cloud-asset inventory. Decide explicitly whether PrepOrder and PrepIQ APIs, mobile app clients, staging assets or connector software are included; list exact approved assets and avoid wildcard scope.
3. Have qualified counsel review the safe-harbor statement, local computer-misuse law and the intended researcher authorization.
4. Deploy the repository's public/.well-known/security.txt, then verify it is served at https://prepstak.com/.well-known/security.txt and that its contact is monitored. Add a security.txt file on other covered origins only if they are under PrepStack's control and the policy is approved there. Maintain the expiry date. RFC 9116 defines the machine-readable format.
5. Confirm whether a paid bounty exists. If one is introduced, publish separate rules before accepting bounty claims.