Responsible disclosure
Found a potential security issue? Tell us responsibly.
If you believe you have identified a security issue involving WayWink, please report it with enough information for the issue to be understood and investigated while avoiding unnecessary access to user or school data.
Report a security issuePurpose
Help us understand the issue without creating additional risk.
WayWink supports school transportation workflows involving students, parents, drivers, vehicles, routes, trips and live operational information.
Because that environment can include sensitive transportation context, potential security issues should be handled carefully. The goal of responsible disclosure is to communicate a finding without unnecessarily exposing information, disrupting active operations or expanding access beyond what is required to demonstrate the issue.
This page provides a reporting path. It does not establish a public bug-bounty program, reward schedule, guaranteed response time or separate legal safe-harbor commitment.
Reporting
What to include in a useful security report.
You do not need to collect additional sensitive information in order to make a report.
A clear description of the potential security issue
The part of WayWink where the issue was observed
Steps that help us understand or reproduce the issue
Relevant screenshots, logs or supporting context when appropriate
The potential impact as you understand it
A way for us to contact you if clarification is required
Sensitive data
If you encounter information that is not yours, stop there.
A potential issue may unexpectedly reveal information connected to a school, student, parent, driver, vehicle or active transportation journey.
If that happens, avoid continuing to browse, download, copy or retain the information simply to demonstrate that additional access is possible. A concise description of what occurred is generally more useful than collecting more affected data.
Please avoid placing sensitive information directly in the email subject line. Describe the issue at a high level first and include only the information needed for the report to be understood.
Testing boundaries
Please avoid activity that could affect real users or school operations.
A security report should reduce risk, not create a second operational problem while demonstrating the first.
Do not access data that is not yours.
If testing unexpectedly exposes student, parent, driver, school or other user information, stop and report the issue rather than continuing to explore the data.
Do not modify or delete real information.
Avoid changing accounts, transport records, routes, trips, attendance, location information or other production data that does not belong to you.
Do not disrupt transportation operations.
Testing should not intentionally interfere with active trips, notifications, tracking, school administration or the availability of WayWink services.
Do not use social engineering.
Please do not attempt to obtain access through impersonation, phishing, manipulation of school staff, parents, drivers or other users.
Do not perform physical security testing.
This disclosure process is intended for potential issues involving the WayWink product and related digital services, not physical access to schools, buses, devices or facilities.
After reporting
A straightforward path from report to review.
Report
Send enough context for the potential issue to be understood without unnecessarily including sensitive user information.
Review
The information can be reviewed to determine whether the behavior relates to WayWink and what additional investigation may be required.
Clarify
Additional information may be requested when the issue cannot be understood from the initial report.
Address
If a product issue is confirmed, the appropriate technical or operational work can be determined based on the nature and impact of the finding.
Review and resolution time can vary depending on the nature, reproducibility, scope and technical impact of a report. No specific response or remediation timeline is promised by this page.
Security vs support
Not every technical issue is a security issue.
Problems with account use, routes, trips, application behavior, device connectivity or normal product operation can usually be handled through WayWink support instead.
Visit SupportReport securely
Send us the details.
Use the security-report subject so the message is clearly identified. Include only the information necessary to explain the potential issue.