Reporting a security problem

1. How to report

E-mail [email protected]. Write in Dutch or English. Please include:

• what you found and where (URL, endpoint, feature);
• the steps to reproduce it;
• what an attacker could do with it;
• how we can reach you.

Also use this address to tell us about a security incident you noticed, such as a leaked password or a gallery link shared where it should not be.

2. What you can expect

• We confirm your report within 3 working days.
• We send an update with our assessment within 10 working days.
• We fix critical problems as fast as we can, and others within 90 days.
• We tell you when it is fixed, and we agree with you when the details can be published. By default that is after the fix, or 90 days after your report.
• With your permission, we name you on our thanks page. There is no bug bounty programme.

3. Please

• Use only test accounts of your own. Do not access, change or delete data of others. If you come across personal data, stop, and tell us what you saw.
• Do not run denial-of-service attacks, spam, social engineering or physical attacks.
• Do not test the services of our subprocessors (such as Cloudflare or Stripe). Report to them directly.
• Give us reasonable time to fix the problem before you share it.

4. Our promise

If you follow these rules and act in good faith, we will not take legal action against you or report you to the police, and we will treat your report confidentially.

5. Out of scope

• Reports from automated scanners without a demonstrated impact.
• Missing security headers or best practices without an attack that uses them.
• Clickjacking on pages without sensitive actions.
• Problems that need a compromised device or browser.
• Rate limits on non-sensitive forms.