How to report
Write to securite@alcess.com (otherwise contact@alcess.com), in French, Arabic or English.
Describe the page or address involved, the steps to reproduce, and what an attacker could obtain. Tell us how to reach you if you wish.
Do not attach anyone else’s personal data: a screenshot showing what CAN be read is enough; what you read is not needed.
What we commit to
Acknowledge receipt within three working days, and give you a first assessment within ten working days.
Keep you informed until the fix. Anything touching restaurants’ money, guests’ data or the tax register is fixed first.
Thank you publicly once the flaw is fixed, if you wish.
What we ask of you
Access only what is strictly needed to demonstrate the flaw. Never view, copy, modify or delete the data of a restaurant or guest other than yourself; test on your own accounts.
No denial of service, no mass sending, no social engineering of our staff or customers, no physical access. Do not collect or refund any real payment.
Give us 90 days to fix before any publication, unless we agree otherwise.
Our commitment to you
If you follow these rules and act in good faith, Alcess will not file a complaint against you nor seek any damages for your research; we will consider it authorised by us.
We cannot bind the public prosecutor: Law No. 09-04 and the Penal Code (art. 394 bis et seq.) punish unauthorised access to a system. That is why the rules above matter.
Scope
In scope: www.alcess.com and the subdomains operated by Alcess, the Alcess Android app, the point-of-sale API.
Out of scope: our providers’ services (payment, database, hosting), report to them directly; content published by restaurants on their storefront; findings without demonstrated impact (missing header without exploitation, self-XSS, version numbers, harmless rate limits).
Reward
Alcess has no bounty programme at this time. We give public thanks, with your agreement.