Report a vulnerability

How to report a vulnerability

• Send a report to info@jaarrekening.io with the subject Beveiligingsmelding Jaarrekening.io: which URL or feature is affected, when you saw it, how to reproduce it with your own test data and what may be affected.
• Limit the evidence to what is necessary. Do not send BSNs, clients' financial data, passwords, session cookies or API keys.
• Keep your research limited. Only use accounts and data you have permission for, stop as soon as you can demonstrate the problem and do not carry out disruptive tests or phishing.
• Agree on the follow-up in the same e-mail conversation, including any public write-up.

For ordinary questions about using the software there is the contact page. The contact details are also in security.txt; more about security on Security and privacy. The full policy is on this page.