In short
- Report it to contact@duelundtech.com
- Describe the problem and how it can be reproduced.
- Test with care
- Do not touch other people's data, and stop as soon as you have shown the problem.
- Good faith is welcome
- If you follow these rules, we will not take action against you for your testing.
- No bounty
- We do not run a bug bounty programme and do not pay for findings.
What is covered
- duelundtech.com and every page under it, including /en/
- the site's administration and its sign-in
Not covered:
- other addresses under the domain (subdomains such as something.duelundtech.com): they are separate systems, and these rules do not give permission to test them
- Simply's servers and systems: problems there are reported to Simply
- attacks that overload the site (denial of service), and automated mass scanning
- social engineering, phishing and physical access
- reports from automated tools without a concrete problem that can be shown
How to report it
Write to contact@duelundtech.com with the subject "Security", and tell us:
- what you found, and where
- how it can be reproduced, step by step
- what an attacker could achieve, in your view
- how we can reach you
Do not send more personal data than needed, and never data you came across while testing.
Rules for testing
- Use only the access any visitor has. Do not guess or crack passwords, and do not use anyone else's sign-in.
- Do not get at other people's data, and do not change or delete anything. Stop as soon as you have shown the problem.
- If you come across personal data or other confidential information, stop, do not keep it, and tell us what you saw.
- Do not overload the site, and do not send many messages through the forms - a single test message is enough.
- Keep the problem to yourself until we have fixed it, or until we have agreed otherwise.
What you can expect from us
- We confirm that we have received your report within 5 working days.
- We look into the problem, keep you informed and tell you when it is fixed.
- We treat your report confidentially and use your information only to handle it. We do not name you publicly without your permission.
Testing in good faith
If you follow these rules and act in good faith, we consider your testing allowed. We will not report you to the police or take legal action against you for it. This applies to us only: others, such as Simply, may have their own rules.
No bounty
We do not run a bug bounty programme and do not pay for findings.
Changes
When this page changes, it gets a new version number and a new date at the top. Earlier versions are listed at the bottom of the page.
Versions
- Version 1from Current