Download

Responsible Disclosure

We take the security of Breeze and our users' data seriously. If you have found a vulnerability in our app, website or any of our systems, please tell us so we can fix it. We'd like to work with you to resolve it before it's made public.

How to report

Email security@breeze.social with:

  • What the vulnerability is and where you found it
  • The steps to reproduce it, or a proof of concept
  • Your contact details, so we can follow up

We read reports in English and Dutch. Our contact details are also published in our security.txt.

What we ask of you

  • Don't exploit the vulnerability beyond what is needed to demonstrate it. Don't download, change or delete data that isn't yours, and stop as soon as you reach other people's personal data.
  • Don't share the vulnerability with anyone else until we have fixed it.
  • Don't use social engineering, physical attacks, denial-of-service, spam, or automated scanning that degrades our service.
  • Don't place backdoors or malware, and don't change our systems.

What we promise

  • We confirm receipt within two working days, and follow up with our assessment and an expected timeline.
  • We keep you informed of our progress.
  • We fix vulnerabilities as fast as their severity requires. Together with you we agree when the vulnerability can be made public, at most 90 days after your report unless we agree otherwise.
  • We won't take legal action against you if you report in good faith and follow the rules above.
  • We treat your report confidentially and don't share your details without your permission.
  • If you'd like, we'll name you as the finder once the vulnerability is fixed.

We don't have a formal bug bounty program with fixed rewards. For a report that helps us fix a real issue, we may pay a reward at our discretion, depending on its severity and quality.

Out of scope

  • Findings from automated scanners without a demonstrated impact
  • Missing security headers, cookie flags or SPF/DKIM/DMARC records without a demonstrated impact
  • Clickjacking on pages without sensitive actions
  • Vulnerabilities in third-party services we use; please report those to the vendor