Request a Ride Online
Business Login

Security

Introduction

At Zippy, security is a big deal. We want to offer the best and most secure products and services to you. We value your efforts in helping us to make our platform more secure. If you have found a security issue in our platform, please reach out to us.

Basic Rules & Expectations

  • Don’t do anything that could cause harm to yourself or others.
  • Do respect the privacy of our users.
  • We do not tolerate extortion.
  • Do not publicly disclose findings without our consent.
  • Be respectful when interacting with Zippy staff, we may not answer you immediately because of the workload, but we do respond.

Legal

Always obey your local laws. We explicitly reject criminal activity in any form.

Disclosure Guidelines

  • Test only systems in Scope.
  • Describe the tested system state.
  • Do not use or report findings from automated scanning tools.
  • Do not start DoS attacks or try to generate high loads in general. If you think our servers have a specific problem in handling high loads you can discuss that theoretically with us and we will try to reproduce your findings in a non-productive environment.

The Scope

  • Zippy rider app; iOS, Android, and Web.
  • Zippy driver app; iOS and Android.
  • *.rydezippy.com

Non-Qualifying Security Issues

  • Previously known vulnerable libraries.
  • Unauthenticated/logout/login CSRF.
  • Clickjacking on pages with no data modification actions.
  • Attacks requiring MITM or physical access to a user’s device.
  • SSL/TLS configuration best practice misses or non-TLS communication.
  • Any activity that could lead to the disruption of service (DoS).
  • Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
  • SPF, DKIM, DMARC issues.
  • Cookie flags.
  • XSS (or a behavior) where you can only attack your own account.
  • XSS on pages where admins are intentionally given full HTML editing capabilities.
  • Reflected file download.

Exclusions

  • Knowingly posting, transmitting, uploading, linking to, sending, or storing any malicious software.
  • Third party apps or websites or services that integrate with, or link to the services of Zippy.
  • Being a worker or partner of Zippy.

Timeline

  • We will try to answer your email within two business days. After our first response we will evaluate your findings and then contact you thereafter.

Disclosure

  • Please refrain from publishing technical details of any security issue you find to give us an opportunity to fix it. We will try to work out a disclosure timeline with you.
  • Before submitting a report, please read our Disclosure Guidelines above.
  • You can submit any security issue in our systems and products to security@rydezippy.com.

Company

Rider

Driver

Business

Download Rider App
Download Driver App
  • © 2024 Zippy
Facebook-square Instagram Tiktok Youtube Linkedin-in

Download Zippy App

google play
apple store

Download Zippy Driver App

google play
apple store