Reporting a security issue

If you think you have found a security problem in My Bermuda Lyft, we want to hear about it. This page explains how to tell us, what you may test, and what we promise in return. We are a small Bermuda business, so we keep it plain.

How to report

Email security@mybermudalyft.com. Please include what you found, the page or address where you found it, the steps to reproduce it, and what you think someone could do with it. Screenshots help. Please do not include anyone else's personal information in your report beyond what is needed to show the problem.

Please use that address rather than the contact form or social media, so your report is recognised as a security report from the moment it arrives, and please do not post details anywhere public (see Telling others below).

What you may test

Our website at mybermudalyft.com, including the booking flow and guest accounts. Use accounts and bookings that belong to you.

What is not covered

• Services run by other companies that we use, including our card payment page (PowerTranz), our hosting (Vercel), our database (Neon), and our email and text message providers (Resend and Twilio). Please report problems in those to the company concerned.
• Any site or preview that is not publicly reachable without signing in to our systems.
• Denial of service, load testing, or anything that slows the site for guests.
• Phishing, social engineering, or contacting our staff, drivers or guests.
• Physical attempts against our vehicles, offices or people.
• Automated scanner output with no demonstrated problem, missing headers with no practical impact, and reports that rely on an out-of-date browser.

Rules while testing

• Never use a card that is not yours, and never try card numbers to see whether they are accepted. That is card testing, which is fraud whatever the intention. If a finding needs a payment, tell us and we will arrange a safe way to show it.
• Do not access, change or delete anyone else's information. If you come across another person's data, stop, do not keep a copy, and tell us.
• Do not make real bookings you do not intend to keep, or reserve seats and vehicles to block other guests.
• Keep automated requests slow and small, and stop if you notice any effect on the service.
• Do only what is needed to show the problem exists.

What we promise

• We will acknowledge your report within 5 working days and give you our initial assessment within 10 working days.
• We will keep you updated while we fix it, and tell you when it is fixed.
• If you would like credit, we will thank you by name once it is fixed.
• If you act in good faith and follow this page, we will not take legal action against you or ask anyone else to, for that research. If someone else does, we will make it known that your research was authorised by this policy.

We do not offer payment for reports.

Telling others

Please give us the chance to fix a problem before you talk about it publicly. We ask you to wait until it is fixed, or 90 days from your report, whichever comes first, and to agree the timing with us if a fix needs longer.