Report a security issue

Did you find a security issue in a site, API or app of Ecliptic? Please tell us. This page says how, which rules to keep to, and what we promise in return.

Scope

Every site and API under ecliptic.nl, and the apps that use them.

Not in scope: other domains, and the services of others, such as Cloudflare, Firebase, Apple and Google. Report an issue in those to them.

How to report

Mail security@ecliptic.nl with:

• what you found,
• how to repeat it,
• how we can reach you.

Write in English or Dutch.

The rules

• Do not read, change or delete more data of other people than the proof needs.
• No denial of service, social engineering, phishing, spam or physical access.
• Do not install a backdoor, not even to show the issue.
• Delete the data you got once the issue is fixed.
• Tell nobody about the issue until it is fixed or 60 days have passed, whichever comes first. We agree with you on how it is made public.

What we promise

• A first answer within 14 days.
• A plan for the fix, and news while the issue is open.
• Credit for the find, if you want it.
• No report to the police and no civil steps against you, if you keep to these rules.

We do not pay a reward in money.