Reporting a vulnerability

If you believe you have found a security problem in Harlow, tell us directly and we will take it from there.

Write to

security@tryharlow.com

Include

What you found, how to reproduce it, and the impact you think it has.

We acknowledge

Within two business days.

We answer with a fix or a timeline

Within ten business days.

Please#

• Do not test against a live hotel's data. Ask us for a test property.
• Do not share the finding publicly before we have had the chance to fix it.
• If you find a credential of ours anywhere, treat it as live and tell us first.

Supported versions

Only the currently deployed version of each part of Harlow is supported. Badges update themselves when a hotel allows it; the connector updates from signed releases.

The policy text lives in SECURITY.md in each of our repositories.