Found a vulnerability? Tell us first.
We welcome reports from security researchers. Here is how to reach us, what is in scope, the rules we ask you to follow and what you can expect from us.
How to report.
Email security@hypamoon.com. Describe the issue, the steps to reproduce it, the affected address and what an attacker could do with it. Screenshots or a short proof of concept help. You can write in English or Dutch.
Our contact details are also in security.txt.
In scope.
- Our own serviceshypamoon.com, app.hypamoon.com, api.hypamoon.com, control.hypamoon.com, status.hypamoon.com and notify.hypamoon.com.
- Customer sites and appsSites and apps on *.hypamoon.app, but only for flaws in the platform, such as one project reaching the data of another. Bugs in a customer's own code are for that customer.
What we ask.
- Leave other people's data aloneDon't access, change or keep data that isn't yours. If you reach it by accident, stop, don't keep a copy and tell us.
- Use your own accountsTest only with accounts and projects you created yourself.
- Keep it quiet and smallNo denial of service, spam, social engineering or physical attacks.
- Tell us firstReport to us before you share anything publicly, and give us reasonable time to fix it.
What we promise.
- A reply within 3 business daysWe confirm that we received your report.
- An assessment within 10 business daysWe tell you what we think of the issue and what we plan to do.
- Updates until it is fixedWe keep you informed along the way.
- No legal actionWe won't take legal action against you over a report made in good faith that follows these rules.
- Thanks, if you want itOnce fixed, we add your name to our thank you list. Only if you want that.
No bug bounty.
We don't pay rewards for reports. We do thank you, publicly if you like.
Out of scope.
We don't take reports on: output from automated scanners without proven impact; missing security headers without a way to abuse it; clickjacking on pages without sensitive actions; SPF, DKIM or DMARC settings; rate limiting without real impact; and bugs in the code of customer sites and apps.
Misuse by a customer, like a phishing site or a spam text, is not a vulnerability. Report it on Report abuse.
Not a security issue?
Our support page explains how to reach us for anything else.