Security policy

If you believe you have found a security vulnerability in CLIMB, please email security@begood.solutions with [SECURITY] in the subject. Include the affected product or URL, a clear description, steps to reproduce, the potential impact and any proof of concept that does not expose real user data.

Do not include passwords, authentication tokens, personal information or customer data in your report. We may ask for more detail using a safe channel.

This policy covers the current production CLIMB service:

• the CLIMB and CLIMB Coach apps for iOS and Android;
• the production web apps at app.climb.begood.solutions and coach.climb.begood.solutions;
• the production API at climb-api-13876340592.europe-west2.run.app.

Staging and preview environments, third-party services, and vulnerabilities that require a compromised device are out of scope. Please report issues in third-party products to their providers.

This policy provides a way to report suspected vulnerabilities; it does not grant permission to probe, scan or test CLIMB. Obtain prior written permission from BeGOOD Solutions Ltd before conducting any security testing, as required by our Terms of Service.

If you have written permission, follow its scope and conditions. Do not access, change or delete another person’s data; disrupt services; use social engineering; or run tests that could affect other customers. Stop and report the issue if you encounter personal or customer data.

We aim to acknowledge reports within 3 business days and provide an initial assessment within 7 business days. We aim to fix confirmed critical issues within 72 hours and high-severity issues within 7 days. These are targets, not guaranteed deadlines; timing can depend on severity, complexity and safe validation.

We will coordinate with you before any public disclosure. If you would like credit, tell us in your report; we will only identify you with your permission.

For vulnerability reports, contact security@begood.solutions. For other product support, email help@begood.solutions.