Email bw79814513@gmail.com with the subject line Security. Include enough to reproduce the problem — a URL, a request, a screenshot, the account you were signed in as. If you would rather not put details in email, say so and we will arrange another way.
We will acknowledge within 3 business days and tell you what we found within 14 days, including when we expect to fix it. If a fix will take longer than that, we will say so rather than go quiet.
Use your own account, or one you have been given permission to use. Do not access, change or delete a dealer's books, inventory or photos that are not yours. Do not run automated scans that degrade the service for the people using it. Give us a reasonable chance to fix something before describing it publicly.
If you follow that, we will not pursue a complaint against you for the research itself. We are a small team and do not run a paid bounty, but we will credit you if you want to be credited.
Anything that lets one dealer read or change another dealer's data. Clody keeps every business table behind row-level security scoped to a team, so a path around that is the thing we most want to hear about.
Anything that makes private data public. Four database views deliberately serve a dealer's published shop to anyone with the link; a way to read through them to something a dealer did not publish — what they paid for a card, their transactions, buyer identities — is in the same category.
Anything to do with assistant keys: reading one back, acting as a team without one, or using one past the moment it was revoked.
Reports from automated scanners with no demonstrated impact, missing headers on pages that carry no data, rate limiting on endpoints that only serve public shop pages, and anything requiring a dealer to install something or hand over their own password.
We fix it, and then we check the logs for whether it was used. Every assistant call is recorded with its outcome, and every rejected key is recorded by its first few characters, so "was anyone affected" is a question we can usually answer rather than guess at. If a dealer's data was reached, we tell that dealer what was reached and when.