Vulnerability Disclosure Policy

Endless Blue Pools is a local pool-service business, not a software company — but this website takes quote requests and stores customer details, so we take reports about it seriously. If you have found a security issue, thank you for telling us.

How to report

Email email protected with "Security" in the subject line, or call (737) 707-5516. Include the page or address involved, what you did, and what you saw. Screenshots help. The machine-readable version of this page is /.well-known/security.txt.

What we ask

• Do not access, change or download other people's data. If you hit customer information by accident, stop and tell us what you saw.
• Do not run denial-of-service tests, automated scanning at high volume, or social-engineering against our staff or customers.
• Give us a reasonable time to fix the problem before you publish anything about it.

What you can expect

• An acknowledgement within 5 business days.
• A straight answer on whether we consider it a real issue, and roughly when it will be fixed.
• No legal action against good-faith research that follows the requests above.
• Credit here if you want it. We do not run a paid bounty programme.

Scope

This policy covers endlessbluepools.com and its subdomains. Third-party services we use (Google, Microsoft, Cloudflare, our email provider) have their own programmes — please report issues in those products to them directly.