Security
Responsible disclosure policy
If you believe you have found a security flaw on this site, we want to hear about it.
How to tell us
Use the contact form, select “Other” and state in the message that it is a security report. Describe the issue, the steps to reproduce it and its possible impact. See also our security.txt file.
What we ask of you
- Act in good faith and limit yourself to what is needed to demonstrate the issue.
- Do not access, modify or delete other people's data.
- Do not run denial-of-service attacks, spam or social engineering.
- Give us a reasonable time to fix it before making it public.
What you can expect from us
- We will acknowledge receipt, typically within 5 working days.
- We will keep you informed about the fix.
- We will not take legal action against anyone acting in line with this policy.
- We will credit your contribution if you wish.
Scope
This policy covers this website and its own subdomains. Our clients' systems are out of scope: disclosure for those is up to each owner. We do not currently offer monetary rewards.