Security

Core controls

• HTTPS encrypts traffic in transit.
• Passwords are handled and hashed by the authentication provider; LineupUK does not store readable passwords.
• Database row-level security limits a signed-in barber to their own records.
• Profile-photo writes are limited to the authenticated owner’s storage path.
• Secrets stay server-side and are not exposed through public environment variables.
• Booking conflicts are enforced at the database layer rather than by a browser check.

Responsible disclosure

Send suspected vulnerabilities to bookings@lineupuk.comwith “Security report” in the subject. Include the affected URL, impact and minimum steps needed to reproduce it. Do not include client personal data unless we provide a secure transfer route.

Research boundaries

• Do not access, alter, download or retain another person’s data.
• Do not use denial-of-service, spam, social engineering or physical attacks.
• Use the smallest proof needed and stop once the issue is demonstrated.
• Allow reasonable time for investigation before public disclosure.

We acknowledge genuine reports and keep reporters updated where practical. LineupUK does not currently operate a paid bug-bounty programme. Personal-data concerns are handled under the Privacy Policy and incident-response process.