If you think you have found a weakness in eznest, please tell us. We would rather hear about it from you than not hear about it at all. This policy says what you may test, how to report what you find, what we do in return and how quickly, and what we do not do.
It is short on purpose, and it repeats the security-research paragraph of section 8 of the Acceptable Use Policy in full. If the two ever differ, the Acceptable Use Policy governs, and we will correct this page.
1. How to report
Write to support@eznest.ca with "Security" in the subject, before you test anything. This is the one address we use for security problems. Write in English or French. Our machine-readable contact details are in security.txt, and they give the same address.
A report is most useful when it says:
- what you found and where (the address of the page, or the name of the app screen);
- the steps to make it happen again;
- what you think someone could do with it;
- how you would like us to reach you.
Please do not put other people’s personal information in your report. If you came across any, tell us that you did and what kind, and we will take it from there.
2. What is in scope
This policy covers:
- the eznest website at eznest.ca;
- the eznest iPhone app and the eznest Android app;
- the services eznest runs that the website and the apps call.
3. What is out of scope
Please do not do these things, and do not report them:
- attacks that overload the service, such as flooding it with requests, and anything else that interferes with the service for other people;
- phishing, or tricking eznest staff, providers or homeowners, and any physical attack on people or offices;
- tests against accounts that are not yours, or against another company’s services that we depend on;
- automated scanner output with no sign that it can be used against us;
- missing security settings that cannot be used to do harm.
A problem with your own account, a payment or a booking is not a security report. Please use support for those.
4. What testing is not allowed
These come from section 8 of the Acceptable Use Policy and apply to research as much as to any other use:
- Do not try to get at data that is not yours, another person’s account, or our infrastructure. If you reach someone else’s information by accident, stop, do not keep a copy, and tell us.
- Look at no more than you need to show that the problem is real. Do not change, delete or keep other people’s information.
- Do not disrupt the service for other people.
- Do not use eznest AI to act outside your own account or to reveal another person’s information. If you find a way to do it, tell us rather than using it.
- Give us a reasonable chance to fix the problem before you tell anyone else.
5. Our safe harbour
We want to hear from security researchers. We will not pursue good-faith research that is reported to us first and does not access other people’s data. This is the same sentence as in the Acceptable Use Policy, and this page does not widen it. Testing that touches other people’s data, or that disrupts the service, is outside it.
This page is our statement of how we treat research. It is not a legal opinion and it does not speak for anyone but eznest.
6. What we commit to, and by when
- We acknowledge your report within two business days.
- We give you our initial triage within five business days. Triage means we have read the report, tried to reproduce it, and tell you whether we accept it as a security problem and what we will do next.
- We use what you tell us only to find and fix the problem and to contact you about it.
- We tell you when it is fixed, if you want to know.
- We will ask you if we need more detail, in the same email thread.
We are a small company. We do not promise a time to fix a problem, because it depends on what the problem is. We will tell you where it stands if you ask.
7. Credit and thanks
We credit a researcher publicly only by mutual written agreement. If you want to be named, say so in your report or after, and we will agree the wording with you in writing before anything is published. If you would rather stay anonymous, we keep you anonymous.
We do not run a paid bounty programme and we do not promise a reward. We can thank you, and we mean it, but we cannot promise a payment.
Changes
We update this policy as we learn. A change to what we commit to comes with a new version number on this page.
v1.0 — 2026-10-28. First publication of this policy. The Acceptable Use Policy’s security-research paragraph is unchanged; this page adds the scope, the testing limits, the two response times and the credit terms.