Security

Reporting something

Email agosperformance@gmail.com. Tell us what you found, where, and enough for us to reproduce it. You do not need a template and you do not need to prove impact before you write.

We will confirm we received it within three working days, tell you what we think within ten, and let you know when it is fixed. If we disagree that it is a problem we will say why rather than go quiet.

The machine readable version of this is at /.well-known/security.txt.

Safe harbour

If you find something while acting in good faith under the rules below, we will not pursue you and we will not report you. We will treat your report as an attempt to help, because that is what it is.

• Test only against this site and only with accounts and data that are yours
• Stop as soon as you have confirmed a problem exists, and do not go further into it
• Do not access, change or keep anyone else's data. If you see some by accident, stop and tell us
• No denial of service, no load testing, no spam, no social engineering of us or our suppliers
• Give us a reasonable chance to fix it before you publish

We do not run a paid bounty. We will credit you here if you want, and we would rather say thank you in public than let a fix go out looking like it happened by itself.

Out of scope

• Anything on Google's systems, or on GCash, Maya, RCBC or GoTyme. Report those to whoever runs them; they have their own programmes
• Missing headers with no demonstrated impact, and scanner output pasted without a working case
• Reports that depend on an already compromised device, or on a browser extension the visitor installed
• Social engineering, physical access, and anything aimed at our staff rather than our software

What we already do

• No card fields anywhere on this siteYou pay in your own banking app against a QR code. There is nothing on this site that asks for a card number, a wallet PIN or a bank login, and there never will be
• Prices are calculated on the serverThe browser sends items and quantities, never an amount, so a tampered request cannot change what you are charged
• One third party script, and it is a visit counterEvery font, stylesheet and image, and every other script, comes from our own domain. The one exception is Plausible, which counts visits without cookies and is pinned to its own origin in the content security policy. There is no tag manager and nothing that could read your order
• A content security policy that blocks the restScripts, frames, objects and form targets are restricted to this origin, and the site cannot be framed by anyone
• Browser storage is treated as hostileEverything read back out of local storage is validated and escaped before it can reach the page, because storage is writable by anything else running on the machine
• An uploaded receipt is not a confirmed paymentA screenshot can be forged, and software that reads one cannot tell. Every payment is checked by a person against our own account before an order is marked paid or anything is packed

What we have not done

We have not had a penetration test. The site has no login, so there are no accounts to take over, and no customer data is stored on this origin. If a form is ever added here it will need server-side validation and rate limiting before it goes live.

Saying this in public is deliberate. A security page that lists only strengths is marketing.