Security & responsible disclosure

Email security@pickyou.ca. This mailbox is monitored and is the correct channel for suspected vulnerabilities.

• A clear description of the issue and its impact.
• The exact URL, endpoint or screen involved.
• Step-by-step reproduction instructions.
• The account role used (rider, driver, operator, administrator) — describe it; do not send credentials.
• Date and approximate time, with timezone, of the test.
• Any request or response evidence, with personal information removed.

• Do not access, modify, download or delete data belonging to other people.
• Use only accounts you own or have written permission to test.
• Do not disrupt the service: no denial-of-service, no load or stress testing, no spam, no social engineering of PickYou staff, riders, drivers or operators.
• Do not attempt to move real money, create real rides, or interfere with a live trip.
• Do not publicly disclose an issue before we have had a reasonable opportunity to investigate and respond. We request coordinated disclosure.

We acknowledge reports we receive and investigate them. We will keep the reporter informed of the outcome where we can.

PickYou does not operate a bug-bounty programme and does not offer payment for reports. We make no promise of legal immunity or safe harbour, no guaranteed acknowledgement or remediation deadline, and no commitment here about regulatory notification.

Ride problems, fares, refunds, lost property and account help: help@pickyou.ca. Privacy questions and access requests: privacy@pickyou.ca. Accessibility barriers: accessibility@pickyou.ca. In an emergency, call 911.

The same contact details are published at /.well-known/security.txt in the RFC 9116 format.