Security at RedWeek

RedWeek members and owners trust us with their accounts, postings and payments. Protecting that information is a priority, and we welcome reports from anyone who finds a security weakness in our services.

RedWeek's security program is led by our Head of Cybersecurity.

Reporting a security issue

Email soc@redweek.com. Please include:

  • the affected URL or feature;
  • steps to reproduce the issue;
  • what an attacker could do with it (the impact);
  • how we can reach you for follow-up questions.

We will acknowledge your report within 3 business days and give you an initial assessment within 10 business days. We'll keep you updated until the issue is resolved.

Scope

In scope: the RedWeek website at www.redweek.com, including the RedWeek blog (www.redweek.com/blog) and the RedWeek API (www.redweek.com/api).

Out of scope:

  • services run by third parties, such as payment providers, financing partners, hosting providers and our customer-support tools, even where they appear on a redweek.com address (please report those to the provider);
  • systems operated by resorts or other partners;
  • social engineering of RedWeek staff, members or owners;
  • physical access to offices or data centers;
  • denial-of-service or load testing;
  • reports from automated scanners without a demonstrated, real impact.

Guidelines

  • Use only accounts you own, or test accounts you create. Do not access, change, download or keep data that belongs to anyone else. If you encounter someone else's data, stop, and tell us in your report.
  • Do not disrupt our services, degrade performance for other users, or destroy data.
  • Avoid automated high-volume scanning.
  • Give us a reasonable amount of time to fix the issue before you share it publicly. We ask for 90 days, and we're happy to coordinate a disclosure date with you.

Safe harbor

If you make a good-faith effort to follow this policy during your security research, we will consider your research authorized. We will work with you to understand and resolve the issue quickly, and RedWeek, Inc. will not initiate or support legal action against you related to your research. If legal action is initiated by a third party against you for activities that were conducted in accordance with this policy, we will make this authorization known.

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please contact us at soc@redweek.com before going any further.

Rewards

We do not run a formal bug-bounty program. At RedWeek's discretion, we may pay a reward for valid reports with a meaningful security impact. We thank every reporter who helps keep RedWeek secure.

About this policy

This policy is also referenced from our security.txt file. Last updated: October 21, 2026.