Report a security issue

Email [email protected]. Please include:

• what you found, and where (a URL or an app screen)
• the steps to reproduce it
• what someone could do with it
• how we can reach you

Please keep it private until it is fixed. We read every report and may contact you.

• trackday.com.au and its subdomains
• club sites hosted on Trackday, on a trackday.com.au subdomain or on a club's own domain
• the Trackday iOS and Android apps
• the Trackday API behind them

• services we do not run, such as Cloudflare, Stripe, Google, Apple, or a club's Facebook page: please report those to them
• social engineering or phishing of our staff, members or clubs
• physical attacks on people or premises
• denial of service, load or volume testing
• automated scanner output without a way to show the issue

• Use your own accounts, or test accounts you created.
• Do not read, change or delete anyone else's data.
• If you reach another person's data, stop, do not keep a copy, and tell us what you saw.
• Do not slow down or break the service for other people.
• Give us a reasonable time to fix an issue before you talk about it publicly.

If you research in good faith and follow this page, we will not pursue legal action against you for that research.

We do not run a paid bug bounty.