Vulnerability Disclosure Policy

GO RIDE, Inc.We (hereinafter, “the Company”) welcome vulnerability reports from security researchers and users to help ensure the safe use of “GO SUB,” our subscription management app.

This policy describes how to submit a report, what we ask reporters to do, and how we will respond.
This is not a bug bounty program. We do not provide monetary or other rewards for reports.

Scope

Testing is limited to GO SUB installed on a Shopify development store that you created yourself.

In scope:

  • The GO SUB admin interface (the app embedded in Shopify admin)
  • The GO SUB customer portal (customer-facing screens displayed under the store’s  /apps/ )
  • Theme blocks, checkout extensions, and customer account extensions provided by GO SUB

Out of scope:

  • Shopify itself (admin, checkout, payments, etc.). Please report Shopify vulnerabilities to  Shopify’s HackerOne program .
  • Parts of our official website (goriderep.com) other than GO SUB
  • Themes and third-party apps in stores that have installed GO SUB

How to report

Please report by email to the address below.

app.support@goriderep.com

Please begin the subject line with “【Vulnerability Report】”. Include the following information in the body, to the extent possible.

  • The page, URL, or feature where the vulnerability exists
  • Steps to reproduce
  • Potential impact
  • The domain of the development store used for testing (xxx.myshopify.com)

Our response

  • We will acknowledge receipt of your report within three business days.
  • After reviewing the details, if we determine that it is a vulnerability, we will work on a fix and inform you of our findings and response status.
  • If we determine that the issue does not qualify as a vulnerability, we will let you know where possible.
  • The time required for investigation and remediation varies depending on the issue, so we cannot promise a specific timeline.

What we ask you to do

  • Do not conduct testing outside the scope.
  • Do not access or operate stores or accounts that you do not own without the owner's permission.
  • Please take care not to access personal information (such as customers' names, addresses, or email addresses). If you access it unintentionally, do not view or save any more of it, and report it promptly.
  • Do not engage in activities that could disrupt services or degrade performance (such as sending excessive requests or launching DoS attacks).
  • Do not attempt to log in by brute-forcing or guessing passwords.
  • Do not engage in social engineering against our employees, stores using GO SUB, or their customers.
  • Please do not submit only the results of automated scanning tools without explaining the impact.
  • Do not disclose the vulnerability until we have completed remediation and agreed to its disclosure.
  • If you believe your testing could cause or has caused damage, stop testing immediately and contact us.

Safe Harbor

We consider research and reporting conducted in good faith and in accordance with this policy to be authorized, and will not take legal action against the reporter. If a third party takes legal action against the reporter, we will make clear that their actions complied with this policy.

We reserve all legal rights regarding any conduct that violates this policy.

Other

  • We may use the information you report to improve GO SUB.
  • This policy may be revised without prior notice. Any revisions will take effect when posted on this page.

Date of enactment: October 20, 2026