Responsible Disclosure Policy

Goosechase Responsible Disclosure Policy

Last updated: October 2026

Originally inspired by scavenger hunts, Goosechase is an online platform that enables organizations and schools to engage, activate, and educate their communities through delightful interactive Experiences. Hatched in Canada, Goosechase has powered over 1 million global team building, training, fundraising, education, tours, and recreational games since 2011.

One of our greatest privileges has been creating delightful Experiences for an incredibly wide range of people, from elementary school students to military service members, and that privilege comes with responsibility. The privacy and security of our creators and participants are paramount to us, and we build and run our systems with that front of mind. Still, no platform is immune to vulnerabilities, and if there is one in ours, we would far rather hear about it from a researcher than find out the hard way.

If you have found something, we want to know. This policy explains how to tell us, what you can expect from us, and what we ask of you in return.

Mutual expectations

What you can expect from us

We will respond in a timely manner to your report.
We will work with you to understand and validate what you have found.
We will fix confirmed vulnerabilities as quickly as we reasonably can (based on the severity of the vulnerability reported)
We will recognize your contribution to keeping Goosechase secure.

What we expect from you

Report what you find to us as soon as you reasonably can, and do not exploit it or use it for any purpose other than reporting it to Goosechase.
Do not research our systems with the intention of harming Goosechase, our customers, our participants, or our partners.
Do not access, use, copy, or share any data beyond what is strictly needed to demonstrate the vulnerability. If you come across personal information or Experience content that is not yours, stop, do not download or store it, and tell us in your report.
Do not engage in social engineering, phishing, spamming, or denial-of-service attacks against Goosechase, our team, or our users.
Do not test the physical security of any Goosechase office, property, or team member.
Do not break any applicable laws in connection with your research or your report.
Keep your report confidential. Do not share the vulnerability, the contents of your report, or the fact that you have reported one with any third party unless we have agreed to it in writing.
Understand that you are making your report without any expectation or requirement of a reward or other benefit.

Scope

In scope: systems and configurations that Goosechase operates, hosts, or manages for its own use. That includes the Goosechase website, the Goosechase web app, the Goosechase mobile apps for iOS and Android, and the APIs that serve them.

Out of scope:

Third-party services we build on or integrate with, such as cloud computing providers, app stores, payment processors, and email or analytics providers. These have their own disclosure policies and are not covered by this one.
Our customers’ own systems, networks, and devices.
Findings that depend on social engineering, physical access, or denial of service.
Behaviour that reflects an organizer’s chosen settings. For example, content an organizer has chosen to make discoverable, or to make visible to every participant who has joined their Experience, is working as designed and is not a vulnerability.

If you are not sure whether something is in scope, email security@goosechase.com before you start.

Submitting a report

Please include at least the following:

Your severity assessment (Critical, High, Medium, or Low).
A short description of the vulnerability.
Step-by-step instructions to reproduce it. The more detail the better: screenshots, sample requests and responses, or a short screen recording all help.
The affected asset: URL, app, or API endpoint.
The date and time of your testing, plus the account(s) and IP address(es) you used, so we can match your activity to our logs.
Your preferred contact method.

Please use test accounts you have created yourself rather than anyone else’s, and keep your testing to the minimum needed to demonstrate the issue. If your report contains sensitive details, you can encrypt it using the public key listed in our security.txt.

Ground rules

To encourage research and to keep a clear line between legitimate research and a malicious attack, we ask that you make a good-faith effort to:

Play by the rules, including this policy, our Terms of Service, and any other agreement you have with us. Where a restriction in our Terms of Service would prohibit research that this policy permits, this policy applies to that research. All other terms of the Terms of Service continue to apply.
Report any vulnerability you discover promptly.
Avoid harming the confidentiality, integrity, or availability of our systems and data. That means no destructive testing, no automated scanning at a volume that could degrade the service, and no changing or deleting data that is not yours.
Under no circumstances should you ever violate the privacy of others. Use test accounts you have created yourself, and create your own Experience to test against rather than joining one run by our customers.
Never engage in extortion. Do not demand payment, and do not make disclosure conditional on compensation.

Safe harbor

If you conduct your research and disclosure in good faith and in accordance with this policy, in relation to systems that Goosechase operates, we consider your research authorized and will not initiate legal action against you. Specifically:

We will not bring a claim against you for research conducted in compliance with this policy, and we waive any restrictions in our Terms of Service that would otherwise prohibit that research, for the limited purpose of that research only.
We consider research conducted in compliance with this policy to be authorized for the purposes of applicable anti-hacking and computer-misuse laws.

Whether research was conducted in good faith and in accordance with this policy is determined by Goosechase, acting reasonably. The safe harbor does not apply to conduct that breaches this policy, even in part.

To be clear: accessing, downloading, retaining, or using anyone’s data beyond the minimum needed to demonstrate a vulnerability, or sharing it with anyone other than Goosechase, immediately voids this safe harbor.

This safe harbor is given by Goosechase only. It does not bind our customers, participants, or any other third party, and it does not extend to accessing, retaining, or using personal information or Experience content beyond what this policy allows. Nothing in this policy prevents us from complying with the law, a court order, or a lawful request from a regulator or law enforcement.

This safe harbor applies only to systems that Goosechase operates and only to research that follows this policy. You remain responsible, as always, for complying with all applicable laws. If at any point you are unsure whether what you are doing is covered, stop and email us at security@goosechase.com before going any further.

We may update this policy at any time. The version published at the time of your research is the one that applies to it.

Rewards

Goosechase does not run a bug bounty program and does not offer fixed rewards, whether money or giveaways. Any reward we choose to give is at our sole discretion, on a case-by-case basis, only for reports that comply with this policy, and never where payment has been demanded.

How to contact us

Our official channel for security reports is email: security@goosechase.com.

If you need to send us anything sensitive, please encrypt it using our public key, which you can find at https://goosechase.com/.well-known/pgp-key.txt.