Found a vulnerability in GraidLens? Let us know. We welcome everyone who helps us keep the data of schools, teachers and students safe.
How to report
- Email security@graidlens.eu, in English or Dutch.
- Describe what you found, on which page or route, and how we can reproduce it.
- Tell us how to reach you if we have questions.
Rules
- Use your own account. Don't view, change or delete other people's data; demonstrate a vulnerability with as little data as possible and stop as soon as you have.
- No attacks that disrupt the service (such as overloading or spam), no social engineering, no phishing and no physical access.
- Don't share the vulnerability with anyone else until we have fixed it.
- Delete any data you obtained while testing once you are done.
What you can expect from us
- We confirm your report within 48 hours.
- We keep you updated on the fix and agree with you when you may publish about it.
- If you follow these rules, we will not report you to the police or take legal action.
- If you like, we credit you by name when we announce the fix.
We don't run a bug bounty and don't pay rewards.
Outside this policy
Services of our suppliers (such as hosting, email and payments) are not covered by this policy; report problems there to the supplier itself. Reports without a demonstrable risk, such as only a missing header or version number, are still handled, but with lower priority.
More on how we secure GraidLens is on the Security page.