ReadyRun uses layered application and platform controls appropriate to the services we provide. These include restricted administrative access, role-based data permissions, server-side validation, public-endpoint rate limits, verified payment webhooks, secure secret storage, dependency review, encrypted platform transport and security-focused release checks.

Security is an ongoing process. No internet service can guarantee that a vulnerability will never occur, so we maintain a process for receiving, assessing and responding to good-faith reports.

If you believe you have found a security vulnerability affecting a ReadyRun Digital website or system, email hello@readyrundigital.com with the subject “Security Report”.

Please include the affected URL or service, a clear description of the issue, steps to reproduce it, the potential impact and any non-sensitive supporting evidence that will help us verify the report.

Please use only the minimum testing necessary to demonstrate an issue. Do not access, retain, alter, delete or disclose another person's information; disrupt availability; perform denial-of-service testing; send spam; use social engineering; attempt physical intrusion; or introduce malware.

Stop testing if you encounter personal information, credentials, confidential business data or evidence that further testing could cause harm. Report the issue instead.

This disclosure process is not a bug-bounty program and does not authorise conduct that would otherwise be unlawful or breach a third party's terms.

We will triage credible reports, preserve relevant evidence, investigate proportionately, contain confirmed issues and prioritise remediation according to risk. Where an incident affects personal information, our privacy and data-breach response procedures also apply.

We may ask for further information to reproduce an issue. Please do not include passwords, access tokens or personal information in an initial report unless we specifically agree on a secure way to provide it.

ReadyRun HQ is a private administrative surface. Installing HQ to a supported device as a progressive web app does not grant access: the user must still have a current authorised Base44 administrator account. Push subscriptions are created only from an authenticated administrator session, are bound to that user, and notification recipients are revalidated against current administrator access and the staff member's configured business role before delivery.

The HQ service worker is used for push notification delivery and does not cache authenticated HQ responses or customer records for offline use. Notification text is intentionally limited so customer email addresses, phone numbers and detailed project notes are not placed on a device lock screen.

Security reports: hello@readyrundigital.com

Our machine-readable disclosure information is published at /.well-known/security.txt.