Security Who owns it, and how to report an issue.
Found a vulnerability in stipt? We want to hear about it. Here is who you reach and what we agree.
On this page
Who is responsible
Jonah Savonije, founder of stipt, is responsible for the security of stipt B.V. (KvK 42115688). You can reach him at [email protected].
Reporting a vulnerability
Email [email protected] with what you saw, where it is and how we can reproduce it. Do not send other people's data that you do not need to show the issue. You will get a reply within five working days, and we will tell you when it is fixed. We do not run a bug bounty program, so reports are not rewarded.
Rules for researchers
We ask you to follow these rules:
- Test only with your own account in your own workspace. A customer's workspace is out of bounds.
- Do not go further than needed to show the vulnerability, and do not keep or share other people's data.
- No attacks that disrupt the service, and no social engineering, phishing or physical access.
- Give us reasonable time to fix the issue before you make it public.
What we promise
If you follow these rules, we will not report you to the authorities or take legal action against you. This policy is based on the Dutch NCSC guideline for coordinated vulnerability disclosure.
Machine-readable
The same contact details are in our security.txt file (RFC 9116).
How we protect personal data
We describe the technical and organisational measures in the privacy statement and the data processing agreement.