Security Policy

The short version

Found a security issue in BoardFlight? Email us. We’ll read it, acknowledge it, and work on a fix — and we won’t pursue legal action against good-faith research that follows this policy. There is no paid bug bounty program today.

How to report a vulnerability

Email contact@boardflight.com with a plain description of the issue, the steps to reproduce it, and the impact you believe it has. A proof of concept helps. So does a way to reach you if we have follow-up questions.

What we commit to

We aim to acknowledge a genuine report within a few business days and keep you informed as we work on it. If you’d like credit once it’s fixed, we’ll credit you. We won’t pursue legal action against good-faith research conducted under this policy.

What we don’t have: a dedicated security team, a paid bug bounty program, or a formal response-time guarantee. BoardFlight is built by a small team, and reports are handled by the same people who build the product, on the same schedule as everything else they do.

Scope and safe harbor

In scope: the BoardFlight web app at boardflight.com and the API endpoints it calls from the browser. Out of scope: social engineering of anyone on the team, and physical access to our infrastructure.

Please don’t run automated scanning that generates meaningful request volume. Every flight lookup triggers a paid call to our flight-data provider, so a scanner hitting the lookup endpoints repeatedly costs us real money per request, not just server time — test with a small number of manual requests instead. Please also don’t attempt to degrade the service for other travelers, and don’t try to access data that isn’t yours. BoardFlight has no accounts, so there’s no other traveler’s session to reach; the one thing worth not touching is the anonymous report data described below.

What we store

BoardFlight has no accounts and stores no names, emails, phone numbers, or payment data. The only data a visitor supplies that we keep is an anonymous security-wait report: the airport, the weekday and hour, the security lane, and a faster/about-right/slower verdict (or exact minutes, if entered) — tied only to a random identifier your browser generates and stores itself, never to an account, because there isn’t one. The privacy policy covers this in full; nothing here should ever contradict it.

How it’s built to be safe

A few specifics, rather than a general claim of being “secure.” Row-level security is enabled on every database table with zero public policies, so the key our browser code holds has no table access at all — reads and writes are only possible through the server-held key our own API routes use. The browser never talks to the database directly. And when a traveler submits a report, the server recomputes the flight itself rather than trusting what the client sends; the client supplies a flight number, a lane, a verdict, and a device identifier, and the server derives the airport, the time slot, and the predicted minutes on its own.

The site also sends standard browser security headers on every response — HSTS, X-Frame-Options, X-Content-Type-Options, and a Content-Security-Policy among them.

Changes and contact

If this policy changes, we’ll update the date above. Questions about it, or anything else security-related, can go to contact@boardflight.com.