Security policy
We take the security of Slabfolio and our users' data seriously. If you think you've found a vulnerability, please tell us. We'll work with you to fix it.
How to report
Email security@slabfolio.app with: what you found, where (URL or endpoint), steps to reproduce, the impact you see, and how we can reach you. English, German or Czech is fine. Please don't include other people's personal data.
What to expect
- We confirm receipt within 3 business days.
- We send a first assessment within 10 business days.
- We fix issues as fast as their severity requires and keep you updated.
- With your permission, we thank you by name on this page once the issue is fixed.
We don't offer money rewards at the moment.
Please
- Test only with accounts you own, or that the owner allowed you to use.
- Don't access, change or delete other people's data. If you come across it, stop, and tell us what you saw.
- Don't run denial-of-service attacks, spam, social engineering or physical attacks, and don't use automated scanners that put load on the service.
- Do only what you need to demonstrate the issue.
- Give us 90 days to fix it before you publish anything, unless we agree otherwise.
Our promise
If you act in good faith and follow these rules, we consider your research authorised. We won't take legal action against you or report you to the police for it. We can't speak for third parties, such as our hosting provider, or for public authorities.
Out of scope
Reports without demonstrated impact, for example: missing security headers or cookie flags without a concrete exploit, clickjacking on pages without sensitive actions, self-XSS, rate limits on non-sensitive endpoints, email SPF/DMARC settings, software version disclosure, findings from automated scanners without proof, and issues in third-party services we use.
Thanks
With their permission, we list the people who reported an issue we fixed here. No reports so far.
Machine-readable contact: /.well-known/security.txt