Security

Reporting a vulnerability

Last updated: October 20, 2026

Sunshine Golf Holdings, LLC builds and runs Fairways. If you think you have found a security vulnerability in one of the services below, please tell us. We want to hear about it, and we will work with you to fix it.

How to report

Email security@sunshinegolfholdings.com. Please include:

• what you found, and where: the URL, the API endpoint, or the app screen
• the steps to reproduce it, with any proof-of-concept code or screenshots
• what you believe an attacker could do with it
• how to reach you with follow-up questions

Please keep the details private until we have fixed the issue or agreed a disclosure date with you.

What to expect

• We acknowledge your report within 2 business days.
• We investigate, keep you informed as we go, and tell you when the issue is fixed.
• If you would like public credit once the fix is out, tell us how you would like to be named.

Scope

In scope:

• The Fairways web app at app.sunshinegolfholdings.com
• The Fairways API at api.sunshinegolfholdings.com
• Play Fairways, the mobile app for golfers, on iOS and Android
• Fairways Operator, the mobile app for golf club staff, on iOS and Android

Out of scope: the products and services of third-party vendors we use, such as our hosting, database, payment, email and text-message providers. Please report issues in their products to the vendor directly.

While you test

• Use only accounts you own, or have the account holder's permission to use.
• Do not access, change or delete other people's data beyond the minimum needed to show the issue. If you reach someone else's personal data, stop and tell us.
• Do not degrade the service for anyone else: no denial-of-service or load testing, and no spam.
• Do not use social engineering or physical attacks against our staff, our customers, or the golf clubs that use Fairways.

Rewards

We do not run a bug bounty program and do not pay for reports.

Safe harbor

If you make a good-faith effort to follow this policy, we will treat your research as authorized and will not pursue or support legal action against you for it.

Machine-readable contact

Both hosts publish an RFC 9116 security.txt, one for sunshinegolfholdings.com and one for app.sunshinegolfholdings.com.