Responsible disclosure

1. Scope

This policy covers the website rateextra.ae and its forms. Vulnerabilities in the TravelDistro API or the Hotel API should be reported to their operators (api@traveldistro.com, support@safaryarholidays.com).

2. How to report

Email legal@rateextra.ae with a description, steps to reproduce and any proof of concept. Our machine-readable contact is published at /.well-known/security.txt.

3. Rules of engagement

• Do not access, modify or delete data that is not yours; use test data.
• Do not run denial-of-service or automated scanning that degrades the service.
• Do not disclose the issue publicly before we have had a reasonable opportunity to fix it.

4. Safe harbour

Research conducted in good faith and within these rules will not lead to legal action by Rate Extra.

5. What to expect

We acknowledge reports, keep you informed of progress and credit reporters who wish to be named once the issue is resolved. We do not operate a paid bounty programme.