Report a vulnerability

What this policy covers

In scope

• anonify.nl, including www.anonify.nl.
• app.anonify.nl.

Out of scope

• Test, staging and demo environments, such as app3.anonify.nl.
• Systems of third-party providers, such as Cloudflare, Hetzner, Stripe and Calendly. Report a vulnerability there to the provider itself.
• Customers' own systems.
• Social engineering.
• Findings that need physical access.
• Volumetric denial-of-service attacks.
• Missing best-practice headers without a demonstrable impact. We may handle these as low priority.

Rules

We ask you to follow these rules.

• Do only what is needed to prove the issue.
• Do not access, copy, change or delete data, except what you need as proof.
• Never access data or documents of other customers or other workspaces.
• Do you see personal data or customer documents by accident? Stop, do not keep or share them, and say so in your report.
• Do not run denial-of-service or load tests.
• Do not use social engineering, such as phishing or phone calls, and no physical attacks.
• Do not use brute force.
• Do not install malware or backdoors and do not make persistent changes.
• Do not use the vulnerability further than needed, and do not share it with anyone until it is fixed.
• Do not put real personal data in your report.
• Use test accounts where possible.

How to report a vulnerability

Send an email with the subject “Vulnerability” to:

info@anonify.nl

Include in your report:

• what you found;
• the affected URL or host;
• the steps to reproduce the issue;
• the impact as you see it;
• how we can reach you.

You may report anonymously.

We do not have a PGP key yet. So do not send sensitive details in the first email, such as a working exploit with real data. We will then agree a secure way to share them with you.

What we do

• We acknowledge your report within 3 working days.
• We keep you informed about progress. Together with you, we agree a reasonable time for a fix and for disclosure.
• We handle your report confidentially. We do not share your personal details with third parties without your permission, unless the law requires it.
• We only disclose a vulnerability in consultation with you.
• If you want, we name you as the finder after the fix. We only do this with your permission.

No legal action

Do you act in good faith and follow these rules? Then we will not report you to the police and will not take legal action against you because of your report.

This applies to us. It does not bind third parties or the public prosecution service (Openbaar Ministerie).

No reward

We do not run a paid bug bounty and do not promise a financial reward.