Responsible disclosure
Found a security problem in one of our systems? Tell us first, give us time to fix it, and we will work with you, not against you.
1. How to report
Email development@luvarly.com. Describe what you found, where (the URL or system), the steps to reproduce it and what an attacker could do with it. Screenshots or a short proof of concept help. English, Dutch and German are all fine.
Leave a way to reach you. You may report anonymously or under a pseudonym, but then we cannot keep you informed.
2. What is in scope
luvarly.com and its subdomains, including the services that run on them.
Websites and software we build or host for clients belong to those clients. Do not test them without the owner's written permission. If you come across a problem in one by chance, report it to us and we will pass it on to the owner.
Not in scope: reports from automated scanners without a demonstrated impact, such as missing security headers, cookie flags, TLS settings or email policy (SPF, DKIM, DMARC) on their own. Report them anyway if you can show how they can be abused.
Want your own systems tested? That is what our cybersecurity service does.
3. What we ask of you
Report the problem to us as soon as you can, and do not share it with others until it has been fixed.
Do no more than needed to show the problem. Do not view, copy, change or delete data that is not yours. If you reach personal data by accident, stop, report it and delete what you have.
Do not use denial of service, social engineering, phishing, physical access, spam or brute force, and do not place a backdoor or malware, not even to prove a point.
Keep automated scanning light enough that our systems and other users do not notice it.
4. What we promise
We confirm your report within three business days and give you our assessment and an expected fix date within ten business days. We keep you informed until the problem is solved and aim to fix it within 90 days.
If you follow these rules, we will not take legal action against you and will not report you to the police for your report.
We treat your report confidentially and do not share your details without your consent, unless the law requires it. We use them only to handle your report. Your rights over them are in our privacy statement.
If the problem is in a client's system, we share your report with that client, without your details unless you agree.
We do not run a paid bug bounty. For a serious, well-documented report we may send a small token of thanks, at our discretion.