Vulnerability disclosure

If you found a security problem in DisplayMe, we want to hear from you.

How to report

Email security@your-domain.example with: what you found, the steps to reproduce, and the impact. Please do not include real customer data. You can also read our security.txt.

We aim to acknowledge reports within 3 business days and to keep you informed until the issue is fixed.

In scope

The DisplayMe admin site and its API (/api/*)
The TV player (/tv) and pairing pages
Sign-in, roles, store access limits, file upload and download

Out of scope

Denial-of-service, load or brute-force testing
Social engineering or physical attacks on staff or stores
Weaknesses in third-party services (report those to the vendor), or in a TV’s own firmware
Missing best-practice headers with no demonstrated impact; reports from automated scanners without a proof of concept

Safe harbor

If you act in good faith, we will not take legal action against you or ask others to. Good faith means: you only use your own accounts or test data, you do not access, change or keep other people’s data, you do not disrupt the service, and you give us reasonable time to fix the issue before telling anyone else.

Rewards

We do not run a paid bounty. We will credit you by name (if you wish) once the fix is live.