Prijava sigurnosnog problema

Prijave o sigurnosti Brodiqa shvaćam ozbiljno. Ako pronađete ranjivost na brodiq.com ili u aplikaciji Brodiq, javite mi prije nego što kažete bilo kome drugome.

Kako prijaviti

Pošaljite e-poruku na security@brodiq.com. Navedite:

• što ste pronašli i gdje (URL, stranica ili zahtjev)
• korake za ponavljanje ili kratak dokaz koncepta (proof of concept)
• što bi napadač, po vašem mišljenju, time mogao učiniti

Prijave na hrvatskom, engleskom ili njemačkom su dobrodošle.

Što slijedi

• Odgovaram u roku od 5 radnih dana.
• Obavještavam vas dok se problem ne riješi.
• Ako želite, nakon ispravka navest ću vas kao pronalazača.
• Molim vas da mi date razumno vrijeme za ispravak prije nego što išta objavite.

Opseg

U opsegu: brodiq.com i www.brodiq.com, aplikacija Brodiq na review.brodiq.app i poslužitelj MTA-STS pravila (mta-sts.brodiq.com).

Izvan opsega: uskraćivanje usluge (DoS) velikom količinom prometa, društveni inženjering, fizički napadi i prijave koje samo navode rezultate skenera bez prikazanog utjecaja.

Dobra vjera

Neću poduzimati pravne korake protiv nikoga tko prijavu podnese u dobroj vjeri, drži se ovog opsega, ne šteti posjetiteljima ni njihovim podacima i ne pristupa većem broju podataka nego što je potrebno da se problem pokaže.

Strojno čitljivi kontaktni podaci: /.well-known/security.txt (RFC 9116).

Reporting a security problem

I take reports about the security of Brodiq seriously. If you find a vulnerability in brodiq.com or the Brodiq app, please tell me before anyone else.

How to report

Email security@brodiq.com. Please include:

• what you found and where (URL, page or request)
• steps to reproduce it, or a short proof of concept
• what an attacker could do with it, as you see it

Reports in English, German or Croatian are welcome.

What happens next

• I reply within 5 working days.
• I keep you updated until the problem is fixed.
• If you'd like, I credit you once it's fixed.
• Please give me reasonable time to fix it before you publish anything about it.

Scope

In scope: brodiq.com and www.brodiq.com, the Brodiq app at review.brodiq.app and the MTA-STS policy host (mta-sts.brodiq.com).

Out of scope: denial-of-service by traffic volume, social engineering, physical attacks, and reports that only list scanner output without showing an impact.

Good faith

I will not take legal action against anyone who reports in good faith, stays within this scope, avoids harming visitors or their data, and doesn't access more data than needed to show the problem.

Machine-readable contact details: /.well-known/security.txt (RFC 9116).