Responsible disclosure policy

At MJSConsulting, the security of our systems and those of our clients is very important. If you discover a vulnerability, please inform us so we can take appropriate action quickly.

What we ask of you

• Email your findings to info@macoit.nl. Encrypt your report where possible.
• Do not exploit the issue or access, delete or alter more data than necessary.
• Do not share the vulnerability until it has been resolved.
• Do not use physical attacks, social engineering, denial-of-service or malware.
• Provide enough information to reproduce the issue.

What we promise

• We will respond within five working days with our assessment and expected resolution time.
• We will treat your report confidentially.
• We will keep you informed of progress.
• With your agreement, we will credit you for a correctly reported, previously unknown vulnerability.
• We will not take legal action if you follow these conditions.

Out of scope

• Volume-based attacks such as DDoS, brute force and spam
• Vulnerabilities in third-party software beyond our control
• Missing best-practice headers without demonstrable impact

Contact

Email: info@macoit.nl
See our machine-readable policy at /.well-known/security.txt.