Vulnerability Disclosure Policy

GO RIDE, Inc.(hereinafter referred to as the "Company") welcomes reports of vulnerabilities from security researchers and users in order to safely use the subscription management application "GO SUB".

This policy specifies how to make a report, what the reporter should observe, and our company's response.
This policy is not a reward system. We will not pay monetary compensation for your report.

Scope

Verification is limited to GO SUBs installed in the Shopify development store you created.

Target:

  • GO SUB admin screen (app embedded in the Shopify admin screen)
  • GO SUB's My Page (customer screen displayed under /apps/ in the store)
  • GO SUB Theme blocks, checkout extensions, and customer account extensions provided by

Excludes:

  • Shopify itself (administration screen, checkout, payment, etc.). Please report Shopify vulnerabilities to Shopify's HackerOne program .
  • Parts of our official website (goriderep.com) other than GO SUB
  • Store themes and other companies' apps that have GO SUB installed

How to report

Please report by email to the following address.

app.support@goriderep.com

Please add "[Vulnerability Report]" at the beginning of the subject line. Please include the following in the body of the text, to the extent possible:

  • Screens/URLs/functions where the vulnerability exists
  • Reproduction steps
  • Assumed impact
  • Domain of the development store used for verification (xxx.myshopify.com）

Our response

  • Once we receive your report, we will contact you within 3 business days. If we determine that the
  • If we determine that there is a vulnerability, we will proceed with the fix and notify you of the verification results and response status.
  • vulnerability does not apply, we will notify you to that effect to the extent possible.
  • The period required for investigation and correction varies depending on the content, so we cannot promise a specific deadline.

What to keep in mind

  • Please do not verify stores or accounts that do not belong to you. Please do not operate without permission.
  • Don't interact with stores or accounts that don't belong to you without the owner's permission.
  • Please try not to touch personal information (customer's name, address, email address, etc.). If you touch it unintentionally, please do not view or save it any further and immediately report it.
  • Acts that may cause service suspension or performance degradation (such as large number of requests, DoS)
  • Do not attempt to log in by brute force or guessing passwords.
  • Our employees, GO SUB.
  • Please refrain from sending automated scan tool results without explaining the impact.
  • Please do not disclose the contents of the vulnerability until we have completed the fix and consented to disclosure.
  • If you believe that testing could or has caused harm, stop testing now and contact us.

Immunity (Safe Harbor)

For investigations and reports made in good faith in accordance with this policy, we will consider this to be an authorized act and will not take legal action against the reporter. Even if a third party takes legal action against the reporter, we will make it clear that their actions were in accordance with this policy.

We reserve all legal rights regarding actions that violate this policy.

Other

  • The content of your report may be used by us to improve GO SUB.
  • This policy may be revised without notice. The revised content will be applied from the time it is posted on this page.

Enactment date: October 20, 2026