Reporting a vulnerability.

This policy covers the web application at schaduwplan.nl, its API, and the serverless functions served under schaduwplan.nl.

Third-party services we use but do not operate — PDOK, the 3DBAG API, Ellipsis Drive, Cloudflare, Supabase, Stripe, Sentry and PostHog — fall under those parties' own policies. See Third-party components below for what we do when a report concerns one of them.

Send your report to [email protected]. That is the same address as in our security.txt (RFC 9116). We have no PGP key; if you need to share something confidential, say so in your first email and we will agree on a channel.

Reports are accepted in Dutch or English. Help us by describing what the problem is, how we can reproduce it, and what impact you expect.

• We acknowledge receipt within 3 business days.
• We give an initial assessment within 10 business days: accepted, duplicate, or out of scope.
• After that we send a status update every 14 days until the report is resolved.
• We fix it — or limit the impact — without undue delay, prioritised by severity.
• Once a fix or mitigation is available, we disclose the vulnerability publicly. We coordinate the timing with the reporter.

We will not pursue legal action over good-faith security research that:

• respects user privacy and data;
• does not degrade the availability of the service;
• does not retrieve more data than needed to demonstrate the issue;
• gives us reasonable time to remediate before public disclosure.

If the vulnerability is in a component we use but do not build ourselves, we report it to its maintainer and coordinate our advisory with theirs.

On request we credit you by name in the advisory about the fixed vulnerability. We pay no monetary reward — Schaduwplan has no bug-bounty programme.

Questions about this page? Email [email protected]. For data processing, see the privacy statement.