Incident Response & Vulnerability Reports
PublishedUpdated September 17, 2026
What happens if something goes wrong, and how to report a vulnerability.
What We Consider a Security Incident
A security incident is any confirmed or suspected event that could compromise the confidentiality, integrity, or availability of MTScheduling or the data it holds - for example, unauthorized access to an account or the database, a vulnerability that could expose data across businesses, or a compromised third-party service we depend on. It also covers a vulnerability a security researcher finds and reports before it's ever been exploited.
How to Report One
If you believe you've found a security vulnerability, or suspect an incident has occurred, email support@mtscheduling.com. For a vulnerability report, include a description of the issue, the steps to reproduce it, and its potential impact - screenshots or a short video are helpful but not required.
Responsible Disclosure Guidelines
If you're a security researcher, we ask that you give us a reasonable opportunity to investigate and fix an issue before disclosing it publicly; avoid accessing, modifying, or deleting data beyond what's strictly necessary to demonstrate the issue; never access another business's data without their explicit permission; and avoid actions that could degrade the Service for real users, such as automated scanning that generates significant load. We won't pursue legal action against researchers who make a good-faith effort to follow these guidelines. We don't currently offer a paid bug bounty, but we're genuinely grateful for responsible disclosure, and will credit you publicly if you'd like once a genuine issue is fixed - or keep your report confidential if you'd prefer.
Our Response Commitment
We will acknowledge and begin responding to any reported security incident or vulnerability within 1–2 business days, and keep you reasonably informed of our progress.
What Happens Next
Once we're aware of a potential incident, we investigate to confirm what happened, contain it, and assess what data or accounts were affected.
Notification
If we determine that a security incident resulted in unauthorized access to personal information, we will notify affected business owners without unreasonable delay, consistent with our obligations under the Florida Information Protection Act and other applicable law.
Contact
support@mtscheduling.com