Security and Vulnerability Disclosure Policy

We welcome reports from security researchers. This policy explains what you may test, how to report and how we protect researchers who follow it. It is published at greengopartners.com/security and referenced in /.well-known/security.txt.

1. Scope

In scope:

• greengopartners.com and its subdomains operated by GreenGo
• GreenGo's public API and MCP endpoint
• The Green Light scanner's behavior, such as a way to make it scan a property without verified control

Out of scope:

• Sellers' products and websites listed on GreenGo — report those to the seller, or to us if the seller does not respond
• Stripe, Lovable, Supabase, Cloudflare and other providers — use their own programs
• Denial-of-service or load testing, spam, social engineering of staff or users, and physical attacks
• Findings that need a rooted or jailbroken device, an outdated browser, or physical access to a victim's device
• Missing best-practice headers or banner disclosure without a demonstrated security impact

2. Rules for testing

• Use only accounts you own or test accounts we give you. Never access, change or delete other users' data.
• If you reach personal data, credentials or payment information, stop, keep only the minimum needed to show the issue, and report it right away.
• Keep automated testing under 10 requests per second, and do not use exploits to move further into our systems or keep access.
• Do not test Stripe checkout with real cards or start real payouts.
• Give us a reasonable time to fix the issue before telling anyone else: 90 days from your report by default, or sooner by agreement.
• Do not demand payment in exchange for not disclosing an issue.

3. Safe harbor

If you make a good-faith effort to follow this policy, we consider your research authorized. We will not pursue or support legal action against you under the Computer Fraud and Abuse Act, New York Penal Law Article 156, the DMCA anti-circumvention provisions or our Terms of Service for that research, and we will make this authorization known if someone else brings a claim about it. This does not cover research that breaks the rules above, or that violates the law in other ways, and we cannot authorize testing of systems we do not own. If you are unsure whether something is allowed, ask us first.

4. How to report

Email info@greengopartners.com with:

• What you found and where (URL, endpoint or feature)
• Steps to reproduce, and proof of concept if safe
• The impact you think it has
• How we can credit you, if you want credit

5. What to expect

We will keep you updated, tell you when the issue is fixed, and with your permission thank you on our acknowledgments page. We do not run a paid bug bounty at launch; we may give discretionary rewards for significant findings, except to anyone we are legally barred from paying.

6. Our commitments

We will tell affected users and regulators about incidents as the law requires, and we will not use this policy to keep problems hidden from them.