We ask you

• to email your findings to and encrypt your findings with our PGP key to prevent the information from falling into the wrong hands.
• not to take advantage of the problem by, for example, downloading more data than is necessary to prove the vulnerability, or by accessing, deleting, or modifying third party data.
• not to reveal the problem to others until it is resolved, and to delete all confidential data obtained through the vulnerability immediately after the problem has been solved.
• not to use attacks on physical security, social engineering, distributed denial of service, spam, or third-party applications.
• to provide sufficient information to reproduce the problem so that we can solve it as quickly as possible. Usually, the IP address or URL of the affected system, and a description of the vulnerability is sufficient, but for more complex vulnerabilities more information may be needed.

We promise

• We will respond to your report within 3 business days with our evaluation of the report, and an expected resolution date.
• If you have followed the instructions above, we will not take any legal action against you in relation to the report.
• We will process your report confidentially and will not share your personal details with third parties without your consent, unless this is necessary to comply with a legal obligation. You may submit a report under a pseudonym.
• We will keep you informed about the progress of solving the problem.
• In the public information about the reported problem, we will, if you wish, publish your name as the discoverer.
• As a token of our gratitude for your help, we offer a reward for every report of a security problem that was not yet known to us. The amount of the reward will be determined based on the severity of the problem, and the quality of the report. The minimum reward will be a €50 voucher.