Responsible Disclosure

Why this page exists

ReportPoppy holds licensed MLS data, agents' client lists, and the reports agents hand to those clients. If you have found a way to reach any of that when you should not be able to, we want to hear from you before anyone else does.

We do not run a paid bug bounty. We do offer a clear channel, a fast answer, and public credit if you want it.

How to report

Email us with the details. Please include:

• What the issue is, and what an attacker could actually do with it.
• The minimum steps to reproduce it, including any account you used.
• Anything that helps us find it: a request, a timestamp, a URL.

We acknowledge within two business days, tell you our assessment within seven, and tell you when it is fixed.

In scope

• reportpoppy.com and everything under it, including the app, the client share links under /r/, and the API.
• The ReportPoppy iOS app and the ReportPoppy Android app.
• The branded client short links on go.chipandkim.com.

The kinds of finding we care most about: reaching another agent's account, reports, or uploaded files; reading MLS data without a valid session; changing what a frozen client link shows; and anything that lets one agent's letterhead appear on another agent's report.

Out of scope

• Anything that requires physical access to a device, or a person to be socially engineered.
• Denial of service, volumetric testing, and automated scanning that degrades the service for working agents.
• Reports generated only by a scanner with no demonstrated impact, and best-practice notes such as a missing header that leads nowhere.
• Third-party services we depend on. Report those to their owners: Trestle and CRMLS, Poppy ID at OfficePoppy, and the payment processor.
• The MLS content itself. If a listing's data is wrong, that is the listing agent's entry, not a security issue.

Safe harbour

If you act in good faith under this page, we will not pursue or support legal action against you. Acting in good faith means:

• You use only your own accounts and test data, and you stop as soon as you have proved the issue.
• You do not access, copy, keep, or share anyone else's data, and you tell us at once if you see any by accident.
• You do not degrade the service, and you do not extort.
• You give us a reasonable window to fix the issue before you publish, and we will agree that window with you rather than impose one.

Deliberately reading another agent's client data, or holding a finding for payment, is outside this page entirely.