Report a vulnerability, with confidence.

Think you have found a vulnerability in sutempo, its API or npm packages? Write to us before discussing it publicly: we will fix it, then publish together if you wish.

Report by email →View security.txt

Report

An email, with steps to reproduce.

A clear report helps us reproduce the issue quickly. No elaborate proof of exploitation is needed: describe what you observed.

contact@sutempo.com Write to us

In French or English; Spanish and Portuguese are also accepted.

Responsible disclosure

What we ask of you, what we do.

On your side

Test in your own sandbox: free, isolated, with a fictional business.
Do not access a real business’s or customer’s data; stop as soon as you have proof.
No denial of service, load testing or social engineering.
Give us time to fix the issue before publishing.

On our side

No legal action for good-faith research within these rules.
Email updates until the fix is complete.
A credit in the changelog once fixed, if you wish.

Scope

What is covered.

In scope

sutempo.com : website, /account, /admin, /console
The API /v1 described by /openapi.json
Business pages and the widget
The MCP server and packages @sutempo/sdk, @sutempo/booking-flow, @sutempo/mcp
Webhooks sent by sutempo

Out of scope

Third-party services themselves: Stripe, Google, Vercel, Neon
Volumetric attacks and load tests
A quota or limit reached without further impact
A missing header without an exploitation scenario
Other people’s accounts and data obtained through phishing

Existing safeguards

What the code already does.

Only what can be verified today.

Scoped, hashed keys

Each pk_… key carries only explicit permissions and applies only to its assigned businesses. It is stored as a hash (scrypt) and displayed only once.

Real businesses with permission

A developer can access a real business only if it is on Pro and its owner authorises access; permission can be withdrawn. The sandbox sends no real emails or payments.

Quotas and rate limits

Per-key, per-business and global quotas. Rate limiting per surface: public page, widget, public writes, sessions. Over the limit: 429 with Retry-After: 60.

Signed webhooks

HMAC-SHA256 over timestamp.body, in x-platform-signature: v1=… with x-platform-timestamp. HTTPS destinations only; private addresses are rejected.

Passwordless sign-in

An 8-digit email code valid for 10 minutes, or Google. Repeated failures are blocked for one minute. Sign out other devices in one click.

Verified payments

Incoming Stripe webhooks are signature-verified; an invalid signature is rejected with 400. Money goes to the business’s Stripe account.

Controlled origins

Browser calls from unauthorised origins are rejected. A Pro business declares which websites may display its widget.

Data in Europe

Application on Vercel, Frankfurt region; PostgreSQL database on Neon, eu-central-1 region. Customer record photos are private.

security.txt

The file, in the right place.

Served as plain text at /.well-known/security.txt, following RFC 9116.

/.well-known/security.txt

Contact: mailto:contact@sutempo.com
Expires: 2027-03-29T00:00:00.000Z
Preferred-Languages: fr, en, es, pt
Canonical: https://sutempo.com/.well-known/security.txt
Policy: https://sutempo.com/developpeurs/securite
Acknowledgments: https://sutempo.com/developpeurs/changelog