Found a security problem?

Good that you are looking. The rules first, so you know where you stand.

No reward

We have no bug bounty and we do not pay for reports. There is no reward, no merchandise and no hall of fame. We do not buy unsolicited audits or pentests. Mails that ask for a reward or a paid audit in return for a finding get no reply.

How to report

Email info@brewersync.com with the subject "Security report". Describe the steps to reproduce it, the affected address and what an attacker could do with it. Without repeatable steps and a clear impact it is not a report. Dutch, English or German is fine.

Testing rules

Testing without our written permission is not allowed. That means no automated scanners on production, no social engineering, no denial of service and no access to data of other people. Do not share anything publicly before we have had the chance to fix it.

What we do not handle

We do not handle, and do not answer, reports from scanners or best-practice checklists without proven impact. Examples: missing headers, SPF or DMARC advice, clickjacking on pages without sensitive actions, version information and rate limits on forms without real consequences.

What we do with a real report

A real report made in good faith gets our attention, and we act on it. We will not take legal action against you over a report made in good faith that follows these rules.

Our contact details are also in security.txt.