Preview. The API is shared with design partners and may change before launch. Register interest for sandbox access.
Responsible disclosure
We appreciate reports from security researchers and partners. If you think you’ve found a vulnerability in Phew, please tell us privately so we can fix it before it’s exploited.
How to report
Section titled “How to report”Email security@getphew.com with:
- A description of the issue and its impact.
- Steps to reproduce it, including URLs, requests and any proof-of-concept code.
- Your name or handle if you’d like to be credited.
Please don’t include real customer data in your report.
What to expect
Section titled “What to expect”| Step | Timeline |
|---|---|
| Acknowledgement | Within 2 business days |
| Initial assessment | Within 5 business days |
| Fix for critical issues | As fast as possible, typically within 7 days |
| Status updates | At least every 14 days until resolved |
Guidelines
Section titled “Guidelines”When researching, please:
- Only test against your own accounts and sandbox data.
- Stop and report as soon as you can access data that isn’t yours.
- Don’t run denial-of-service tests, spam, social engineering or physical attacks.
- Give us reasonable time to fix the issue before disclosing it publicly.
If you follow these guidelines, we won’t take legal action against you for your research, and we’ll work with you to understand and resolve the issue.
In scope: getphew.com and its subdomains, the Phew APIs, and the Phew Shopify and WooCommerce apps.
Out of scope: reports from automated scanners without a demonstrated impact, missing best-practice headers without an exploit, and vulnerabilities in third-party services we use (please report those to the vendor).
A machine-readable version of this policy is at
getphew.com/.well-known/security.txt.