Responsible disclosure policy

At Flatchr, we consider the security of our systems to be a top priority. But no matter how much effort we put into system security, vulnerabilities may still be present.

If you discover a vulnerability, we'd like to know about it so we can take steps to remedy it as quickly as possible. We'd like to ask you to help us better protect our customers and our systems.

Please do the following:
- Send your results by e-mail to security@flatchr.io. Encrypt your results to prevent this critical information falling into the wrong hands,
- Do not take advantage of the vulnerability or problem you have discovered, for example by downloading more data than is necessary to demonstrate the vulnerability, or by deleting or modifying other people's data,
- Do not reveal the problem to others until it has been resolved,
- Do not use physical security attacks, social engineering, distributed denial of service, spam or third-party applications, and
- Provide enough information to reproduce the problem so that we can resolve it as quickly as possible.
- Usually, the IP address or URL of the affected system and a description of the vulnerability will suffice, but complex vulnerabilities may require additional explanation.

What we promise:
- We will respond to your report within 5 working days with our assessment of the report and an expected resolution date,
- If you have followed the instructions above, we will not take any legal action against you in relation to the report,
- We will treat your report with the strictest confidentiality and will not share your personal data with third parties without your permission,
- We will keep you informed of progress in resolving the problem,
- In public information about the reported problem, we will give your name as the discoverer of the problem (unless you request otherwise).
- We strive to resolve all issues as quickly as possible.
- This policy is based on the Responsible Disclosure Policy found at responsibledisclosure.nl, written by Floor Terra and published under the Creative Commons Attribution 3.0 license.