West Marine Vulnerability Disclosure Policy


West Marine welcomes reports from security researchers who help us
protect our customers and systems.

Reporting
Send reports to security@westmarine.com. For sensitive findings you
may encrypt your report using our published PGP public key.

Scope
This policy applies to systems owned and operated by West Marine,
including westmarine.com and West Marine-owned subdomains, mobile
applications published by West Marine, and public-facing APIs
operated by West Marine.

Out of scope: third-party services West Marine uses but does not
operate (including payment processors, shipping providers, and
analytics platforms); physical attacks on facilities; social
engineering of personnel, customers, or vendors; denial-of-service
testing; automated scanning that generates excessive traffic; and
findings in third-party software that has its own disclosure program.

Good-faith research
When conducting research under this policy, please: stop testing once
a vulnerability is confirmed; access only the minimum data needed to
demonstrate the issue; do not modify or delete data, access other
users' data, or retain or share data you encounter; and do not
publicly disclose the issue before West Marine has had a reasonable
opportunity to address it.

Safe harbor
West Marine will not pursue legal action against researchers for
good-faith security research conducted within the scope and conditions
of this policy. Demands for payment in exchange for vulnerability
information, or threats to disclose or exploit vulnerabilities to
pressure West Marine, fall outside these protections.


Encryption
Encryption: https://westmarine.com/.well-known/westmarine_pgp-key.txt