Report a security issue

This covers the JollyBee website at jollybee.buzz, the JollyBee app, the JollyBee till app on card terminals, and the JollyBee widgets that communities place on their own websites. The rest of a community’s own website is run by that community, not by us.

Email security@jollybee.buzz. Please tell us:

• what you found, and what someone could do with it;
• where you found it: the web address, or the app and the screen;
• the steps to reproduce it, with any screenshots, requests or code that help show it;
• your name and how we can contact you.

Do not send us anyone else’s personal information. If you need to show that you could reach it, describe what you saw or blank out the details.

Questions about your own personal information go to our Information Officer, whose details are in our Privacy Policy.

• We will acknowledge your report within 2 business days.
• We will give you our initial assessment within 10 business days: whether we could reproduce the issue, how serious we think it is, and what we plan to do about it.
• We will keep you informed while we work on it, and tell you when it is fixed.
• We treat critical issues as a priority.
• If you would like to be credited, tell us the name to use and we will credit you in anything we publish about the issue.

Business days are Monday to Friday, except South African public holidays. If the issue exposed anyone’s personal information, we also follow the breach process in our Privacy Policy.

While you look for an issue or show it to us, please:

• test only with your own accounts;
• access no one else’s data beyond the minimum needed to show the issue. If you reach anyone’s personal information, stop, do not keep, change or share it, and tell us straight away;
• do not run denial of service attacks or load tests;
• do not use social engineering or phishing against our staff, the communities on JollyBee or the people who use it;
• do not send spam, including through our forms, emails or messages;
• do not attempt physical attacks on our premises, people or equipment, or on the card terminals communities use;
• give us reasonable time to fix the issue before you disclose it to anyone else.

If you are not sure whether something is allowed, ask us first at security@jollybee.buzz.

We will not take legal action against you for research done in good faith under these rules. We can make this promise only for JollyBee: it does not bind other companies, such as our service providers, or the communities that use JollyBee.

• Issues in services run by other companies, such as the payment providers that process card payments, belong to those companies: report them to the company concerned. If the problem is in how JollyBee uses such a service, report it to us.
• There is no paid bug bounty: we do not pay for reports.