Security & Vulnerability Disclosure

Contact

security@clearstack.nl

Please include:

• a description of the vulnerability;
• the affected system, service or URL;
• steps required to reproduce the issue;
• relevant technical information or proof of concept; and
• your preferred contact details.

Please do not publicly disclose a vulnerability before we have had a reasonable opportunity to investigate and address it.

Testing and responsible disclosure

Please only test systems that you own or have explicit permission to test.

Do not:

• access or modify customer data;
• disrupt services;
• perform denial-of-service testing;
• conduct social engineering against ClearStack personnel;
• access accounts belonging to other users; or
• intentionally degrade production systems.

If testing requires activity that could affect production infrastructure, please contact us first.

Our response

We will assess reports in good faith and may contact you for additional information.

We may acknowledge receipt, investigate the issue, take mitigating measures and communicate with you about remediation where appropriate.

Security reports should not be submitted through the general abuse channel unless they also concern customer or network abuse.