Coordinated vulnerability disclosure policy

Email security@declarable.io with anything you find in declarable.io, the app or the free tools. We read every report and we will reply. What we promise you in return is on our security page; the full policy text is not published on this page yet.

We don't run a bug bounty and don't pay for reports. With your permission, we credit you on our acknowledgements page.

Back to our security page, or read our security.txt.

What the terms mean

Coordinated vulnerability disclosure — you tell us first, we fix it, and details are published after the fix or an agreed date
Safe harbour — a promise not to take legal action against someone who follows the policy in good faith
Advisory — a public note saying what the flaw is, who is affected and how to update
CSIRT — the national computer security incident response team that receives reports of exploited flaws
ENISA — the EU Agency for Cybersecurity, which receives the same reports through a single platform
security.txt — a small standard file (RFC 9116) at a fixed address that says where to send security reports

Sources

Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.