Security Report Policy

Last updated: November 12, 2026

Introduction

Mangomint builds salon and spa management software, and keeping our customers’ data safe matters to us. That includes their clients’ health and payment information. If you’ve found a security vulnerability in Mangomint, we want to hear about it. This policy explains what you can test, how to test it, how to report it, and what you can expect from us in return.

Scope

Only the assets listed here are in scope. Anything not listed is out of scope.

In scope:

• app.mangomint.com
• booking.mangomint.com
• clients.mangomint.com
• api.mangomint.com
• meet.mangomint.com
• salonjobs.com

Out of scope:

• Any asset not listed above.
• Third-party services we use (payment processors, messaging providers, hosting providers and similar). Report issues in those systems to the vendor under their own policy.
• Websites belonging to our customers, even if they embed Mangomint booking.

Findings that don’t qualify

When reporting potential vulnerabilities, please consider (1) realistic attack scenarios and (2) the security impact of the behavior. Below, you will find the most common false positives we encounter. The following issues will be closed as invalid except in rare circumstances demonstrating clear security impact.

1. Theoretical vulnerabilities that require unlikely user interaction or circumstances. For example:
   • Vulnerabilities only affecting users of unsupported or end-of-life browsers or operating systems
   • Broken link hijacking
   • Tabnabbing
   • Content spoofing and text injection issues
   • Attacks requiring physical access to a device (unless explicitly in scope)
   • Self-exploitation, such as self-XSS or self-DoS (unless it can be used to attack a different account)
2. Theoretical vulnerabilities that do not demonstrate real-world security impact. For example:
   • Clickjacking on pages with no sensitive actions
   • Cross-Site Request Forgery (CSRF) on forms with no sensitive actions (e.g., Logout)
   • Permissive CORS configurations without demonstrated security impact
   • Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g., stack traces, application or server errors)
   • Comma Separated Values (CSV) injection
   • Open redirects (unless you can demonstrate additional security impact)
3. Optional security hardening steps / Missing best practices. For example:
   • SSL/TLS Configurations
   • Lack of SSL Pinning
   • Lack of jailbreak detection in mobile apps
   • Cookie handling (e.g., missing HttpOnly/Secure flags)
   • Content-Security-Policy configuration opinions
   • Optional email security features (e.g., SPF/DKIM/DMARC configurations)
   • Most issues related to rate limiting
4. Vulnerabilities that may require hazardous testing. This type of testing must never be attempted unless explicitly authorized:
   • Issues relating to excessive traffic/requests (e.g., DoS, DDoS)
   • Any other issues where testing may affect the availability of systems
   • Social engineering attacks (e.g., phishing, opening support requests)
   • Attacks that are noisy to users or admins (e.g., spamming notifications or forms)
   • Attacks against physical facilities
5. Zero-day vulnerabilities where a publicized fix has been available for less than 30 days

We won’t respond to requests for payment for findings on this list.

Testing rules

When testing, you must:

• When possible, attach a custom, unique HTTP header in your requests and include that header in your report
• Not attempt denial-of-service, load or stress testing.
• Not use social engineering, phishing, or physical attacks against Mangomint, our staff, our customers, or their clients.
• Not run high-volume automated scans.
• Only use accounts you created yourself, or test accounts we’ve issued to you.
• Exploit a vulnerability only as far as needed to prove it exists.
• Not pivot to other systems, keep access open, or download, copy or keep any data.
• Stop and report to us immediately if you come across data that isn’t yours.

No writes against real customers

Mangomint is used by real businesses serving real clients. Every business on our platform is a separate customer, and only your own test businesses are fair game.

• Test only against a business you created yourself, which should include Security Research and a consistent identifier for yourself for all future reports (e.g. Security Research MyID).
• Never create, change or delete bookings, waitlist entries, client profiles, messages, payments, reviews or form submissions on a real business. That includes public booking pages, even though anyone can use them.
• If a bug lets you reach another business’s data, demonstrate it between two test accounts you own.
• Reports that involved writes to a real customer’s data don’t qualify for a reward.

Health and payment data

Some of our customers store their clients’ health information and payment details in Mangomint.

• Stop as soon as you realise you may be viewing health or payment data, and don’t view any more of it.
• Report any accidental exposure to us immediately.
• Never use live card numbers for testing.
• Never include health information or card data in your report. A description of what was accessible is enough.

How to report

Email security@mangomint.com with:

• The affected asset (URL or endpoint).
• Clear steps to reproduce.
• The impact, and what an attacker could do with it.
• Any screenshots, requests or proof-of-concept code, with no customer data included.
• Any other relevant details that provide additional context.

What to expect from us

• We’ll acknowledge your report within 5 business days.
• We’ll give you an initial assessment, including whether the report is in scope and valid, within 14 business days after the initial acknowledgement.
• We’ll keep you updated while we work on a fix.
• We’ll let you know when the issue is resolved.

Rewards

Rewards are paid at Mangomint’s discretion, based on the severity and real-world impact of the vulnerability.

• Severity is assessed by Mangomint using our own discretion. Exposure of health or payment data weighs heavily in that assessment.
• Several reports sharing one root cause may be treated as a single issue.
• Report payments and determined severities are non-negotiable.
• Once payment is confirmed, an invoice will need to be sent to security@mangomint.com with the calculated amount.
• Rewards will be sent within 14 business days of the invoice being sent.

Eligibility

To be eligible for a reward, you must:

• Be the first person to report the issue. Duplicates of earlier reports, and issues we already know about, aren’t eligible.
• Have followed this policy, including the testing rules and the no-writes rule.
• Not be a current Mangomint employee or contractor, or have been one in the last 2 years.
• Not be a resident of, or a national of, a country under US sanctions.
• Be at least 18 years old.

Disclosure

Please don’t share details of a vulnerability publicly or with anyone else until we’ve fixed it and given you written permission.

Safe harbor

If you make a good-faith effort to follow this policy while researching systems Mangomint owns and operates, we will consider your research authorized under applicable anti-hacking laws. We also waive restrictions in our Platform Terms and any acceptable use policies only to the extent needed for that research. We won’t bring or support legal action against you for that research, including for getting around our technical controls. If a third party takes legal action against you over it, we’ll make it known that your research was authorized. Good faith means you:

• test only systems Mangomint owns and operates
• access only the data you need to show the issue, and if you find anyone else’s personal, health, or payment information, stop, report it, and don’t keep or share it
• avoid harm, including service disruption, data deletion, social engineering, and physical testing
• report promptly and keep findings confidential until we fix the issue or agree to disclosure
• don’t ask for anything in exchange for not disclosing or using a vulnerability (rewards are governed only by our bounty terms)

This safe harbor covers only claims within our control. It doesn’t bind third parties or limit our compliance with law, legal process, or our obligations to customers. If you’re unsure whether something is allowed, contact us at security@mangomint.com before you go ahead.

Changes to this policy

We may update this policy at any time. The version published here when you submit your report is the one that applies.