Vulnerability disclosure policy
This is a coordinated vulnerability disclosure process only — not a bug bounty. Canonical contact details are also published at /.well-known/security.txt.
In scope
All Horváth Digital Solutions domains, applications, APIs, and customer infrastructure that we operate or host.
Out of scope
Third-party products, services, and infrastructure we do not operate. Reports about third parties may be declined or forwarded where appropriate.
How to report
Prefer the form on this page. Email to security@hdsio.eu is acceptable when the message is OpenPGP-encrypted to our public key. Every report must include a summary, steps to reproduce, the affected asset or URL, and an impact assessment.
Response expectations
We aim to acknowledge reports within 3 business days and provide a substantive update within 10 business days. Timelines may vary with severity and volume.
Safe harbor
If you research and report in good faith, stay within a proof of concept, avoid privacy violations and service disruption, and give us reasonable time before any public disclosure, we will not pursue legal action for that activity.
Recognition
There is no monetary bounty. With your consent we may thank you privately; we do not publish a public acknowledgments or hall-of-fame list.
