Security policy

How to report

Write to [email protected]. You can do so in Catalan, Spanish or English.

So that we can reproduce and assess it, include:

• A description of the vulnerability.
• The steps to reproduce it.
• The impact you believe it has.
• The affected URL or endpoint.

Our commitment

When we receive your report:

• We will acknowledge it within 72 hours.
• We will update you on its status at least every 7 days until it is closed.
• We will fix it within a reasonable time, according to its severity.
• If you wish, we will credit you publicly in the acknowledgments section.

Safe harbour

We will not take any legal action against anyone who researches in good faith and respects this policy.

If you are unsure whether a test is allowed, ask us first at [email protected].

Rules

While you research:

• Do not access, modify or destroy other people’s data. If you come across it by accident, stop and let us know.
• No denial of service (DoS), spam, social engineering or physical attacks.
• Use only accounts that are your own.
• Give us a reasonable time to fix the problem before you make it public.

Out of scope

We do not treat these as vulnerabilities unless you show real impact:

• Reports from automated scanners without proof of impact.
• Missing security headers with no possible exploit.
• Clickjacking on pages without sensitive actions.
• SPF or DMARC configuration.
• Self-XSS.
• Rate limits on non-critical endpoints.

Rewards

We do not have a paid bug bounty programme at the moment. What we can offer is our public thanks, if you want it.

Acknowledgments

People who have reported a vulnerability to us responsibly and agreed to be listed here.