./DISCLOSURE
Responsible disclosure
We want linai.eu to be secure. If you find a weakness in the site, please tell us so we can fix it. We work with people who report in good faith, and will not take legal action against you if you follow the rules below.
How to report
- E-mail [email protected] with “Security” in the subject. Our security.txt has the same details.
- Describe the problem and the steps to reproduce it, and say which page or address it concerns. Screenshots help.
- Leave a way to reach you, so we can ask questions and keep you informed.
What we ask of you
- Report the problem as soon as you find it, and do not share it with others until it is fixed.
- Do no more than you need to show the problem: do not view, copy, change or delete data that is not yours, and stop as soon as you reach personal data.
- Do not use attacks that overload the site (denial of service), social engineering, physical attacks, spam or automated scanners that send large amounts of traffic.
- Do not put backdoors or other changes in place, and do not use the weakness for anything else.
What we promise
- We confirm your report within three working days and tell you how we assess it.
- We keep you informed until the problem is fixed, and aim to fix it within 60 days.
- We handle your report confidentially and do not share your details without your permission.
- If you like, we mention your name as the finder once the problem is fixed.
Out of scope
Reports about the following are welcome, but we usually do not treat them as weaknesses on their own: missing best-practice headers without a shown impact, e-mail settings such as SPF, DKIM and DMARC, rate limits, clickjacking on pages without actions, self-XSS, software version numbers without a working exploit, and denial of service.
This policy follows the guideline for coordinated vulnerability disclosure of the Dutch National Cyber Security Centre (NCSC).