Responsible Disclosure Policy

We appreciate the work of security researchers. If you find a vulnerability in our platform, please report it via this channel — not publicly.

Scope

In scope:

• dayporto.com and all subdomains (*.dayporto.com)
• The mobile PWA
• The OpenAPI / REST API under /admin/api/*

Not in scope:

• Third-party services we use (Mollie, Meta/WhatsApp, Moneybird)
• Attacks on customer environments (e.g. their own subdomain) — report to that customer
• Social engineering, physical attacks, DDoS
• Best-practice findings without actual impact (missing SPF record, self-XSS without context, etc.)

Safe harbor

If you adhere to this policy:

• we will not take legal action,
• we will help coordinate with affected third parties,
• we will credit you (optionally) in our hall of fame.

In return, we ask you to:

• no exfiltrating customer data — stop as soon as you have confirmed access;
• no DoS/DDoS or brute-force attacks on production;
• no publicly sharing exploits before we have had 90 days;
• test only on your own accounts or test accounts provided specifically for that purpose.

Bug bounty

For qualifying reports we pay a reward via our bug bounty program at Zerocopter / Intigriti. Amounts:

• Critical (RCE, auth bypass, cross-tenant data access): € 2.000 – 7.500
• High (privilege escalation, stored XSS with data impact): € 500 – 2.000
• Medium (CSRF on sensitive action, IDOR without bulk): € 100 – 500
• Low (info disclosure, reflected XSS on anon page): € 50 – 100

Amounts are indicative; severity is determined based on CVSS 3.1 and actual impact. Duplicates and out-of-scope issues are not eligible.

Response SLA

• Confirmation of your report: within 3 working days.
• Initial triage and expected next steps: within 7 business days.
• Coordinated disclosure: by agreement, default 90 days.

Contact

Report a vulnerability   security.txt

Email: [email protected] (PGP key upon request).