Modern Security writes about security every day, so this website should practise what it preaches. Still, no system is perfect. If you find a vulnerability, I’d like to hear about it so I can fix it before anyone misuses it. This policy is based on the Dutch practice of Coordinated Vulnerability Disclosure (CVD).
How to report
Send your report to info@modernsecurity.nl or use the contact form (choose the subject that fits best and mention “security” in your message). The same contacts are listed in security.txt.
A good report contains:
- What: the type of vulnerability and the affected address (URL).
- How: the steps to reproduce it, ideally with a proof of concept or screenshots.
- Impact: what an attacker could do with it.
- You: how I can reach you, and the name you’d like in the Hall of Fame (or that you prefer to stay anonymous).
Please keep the report confidential until the issue is fixed.
Scope
In scope:
- www.modernsecurity.nl and modernsecurity.nl, including the contact form.
- Other subdomains of modernsecurity.nl that are operated by Modern Security.
Out of scope: issues in services of third parties, such as Cloudflare, GitHub, Google, Microsoft, Mailgun or Zoho. Please report those to the vendor directly. Also out of scope are findings without a realistic security impact, for example:
- missing security headers or settings that have no demonstrable risk;
- version disclosure or descriptive error messages on their own;
- reports from automated scanners without a verified, working example;
- SPF, DKIM or DMARC configuration advice;
- clickjacking on pages without sensitive actions.
Rules of engagement
To keep testing safe for everyone, please:
- Do no harm: no denial-of-service, no brute-forcing, no spam through the contact form and no tests that make the website slower or unavailable.
- Stay minimal: only do what is needed to show the vulnerability. Don’t change or delete data, and don’t install backdoors or malware.
- Respect privacy: don’t access, copy or keep personal data of others. If you come across it by accident, stop, delete it and mention it in your report.
- No social engineering: no phishing, no physical access attempts and no pressure on people or suppliers.
- Keep it confidential: don’t share the vulnerability with others until it is fixed.
What you can expect
If you follow this policy:
- A quick reply: you receive a response to your report within 5 working days, with my first assessment.
- Updates: I keep you informed about the progress, and I aim to fix confirmed issues as quickly as possible, normally within 60 days.
- No legal action: I will not take legal action against you for your report, and I will not pass your details to third parties without your permission, unless the law requires it.
- Credit: with your permission, your name (or alias) is added to the Hall of Fame below.
- A thank-you: for a valid report I’m happy to send you a small Modern Security thank-you gift, at my discretion. This is a gesture of appreciation, not a bug bounty: there are no cash rewards.
After the fix we can agree together whether, when and how the vulnerability is published.
Hall of Fame
These people helped make Modern Security safer. Thank you!
No reports yet. Your name could be the first.
Questions
Not sure whether something is in scope, or have a question about this policy? Ask first via info@modernsecurity.nl. I’d rather answer a question than receive a report that crossed a line.