Security & Vulnerability Disclosure
Report a vulnerability
If you believe you have found a security issue on cherrypickedsolutions.com or cherrypicked.io, please email miteshmodi@cherrypicked.io with the subject “Security report”. Include the affected URL, steps to reproduce, and the impact you observed. Machine-readable contact details are in our security.txt.
- We aim to acknowledge reports within 5 business days and keep you informed until the issue is resolved.
- Please give us a reasonable chance to fix the issue before public disclosure.
- Please do not access or modify other people’s data, degrade the service (no denial-of-service or volumetric testing), use social engineering, or test physical security.
- Good-faith research that follows this policy will not be treated by us as a violation, and we do not intend to take legal action against it.
- We do not run a paid bug-bounty program, but we are glad to credit researchers who ask.
Security controls overview
- HTTPS only, with HSTS and modern TLS terminated at a managed edge
- Strict Content Security Policy without inline-script allowance, clickjacking protection, referrer, permissions and cross-origin isolation headers
- Input validation on every API request, rate limiting, request-size limits
- Payment card data never touches our systems; payments (if any) happen on Stripe-hosted pages. Our forms reject card numbers
- Pseudonymised IP addresses in audit logs and automatic data-retention purging
- Automated dependency vulnerability scanning and code review before release
See our Privacy Policy for how personal data is handled.