Draft – not yet reviewed by counsel
This text is a draft. It has not yet been reviewed by a lawyer and may still change.
Responsible disclosure
Version 0.2 · Effective date follows legal review
Found a vulnerability in Stokly? Let us know and we'll fix it together.
1. Reporting
Email your finding to info@stokly.nl, with 'Security' in the subject. Describe what you found, how we can reproduce it and what the possible impact is.
2. Ground rules
Do no more than needed to demonstrate the vulnerability. Do not view, change or delete other people's data; use your own test account where possible. No denial of service, social engineering, physical attacks or spam. Do not share the vulnerability with others until it is fixed.
3. What we do
We respond within 5 working days with a first assessment and keep you informed. If you follow these rules, we will not take legal action. If you wish, we will credit you as the finder.
4. Out of scope
Reports without demonstrable impact, such as missing headers without an abuse scenario, vulnerabilities in third-party services and automated scanner output without explanation.
Questions about this document? Email info@stokly.nl.