Responsible disclosure

What we ask of you

• Submit your report via: email to info@homii.nl.
• Don’t exploit the vulnerability. Only access the minimum data needed to demonstrate the issue. Do not view, delete or modify third-party data.
• Maintain confidentiality. Please don’t share details of the finding publicly until it’s resolved—and delete any confidential data you obtained as soon as the issue is fixed.
• Avoid disallowed techniques. Do not use physical attacks, social engineering, distributed-denial-of-service (DDoS), spam or attacks on third-party applications.
• Provide clear reproduction steps. Include the affected URL or IP address, a description of the vulnerability, and—where applicable—detailed steps to reproduce the issue.

What we promise

• Timely acknowledgement. We’ll respond to your report within five business days, including our initial assessment and an estimated timeline for resolution.
• Safe harbor. If you’ve acted in good faith and complied with these guidelines, we will not initiate legal action against you for your report.
• Confidential handling. Your report and any personal information you provide will be kept confidential. We won’t share your details without your consent, except where required by law. Pseudonymous submissions are welcome.
• Ongoing updates. We’ll keep you informed about our progress toward a fix.
• Recognition of your work. If you’d like, we’ll credit you by name (or handle) in our internal advisories or public acknowledgments once the issue is resolved.
• Collaboration on disclosure. We aim to resolve all reports swiftly and are open to working with you on any post-resolution write-ups or publications.

Thank you for helping us keep homii.nl safe! If you have any questions, please don’t hesitate to reach out at the reporting link above.