Security & responsible disclosure

Working Together

If you discover a vulnerability in one of our systems, we would appreciate it if you let us know so we can take action as quickly as possible. We are committed to working with you to do everything we can to better protect our systems.

No Invitation to Actively Scan

Our Responsible Disclosure policy is not an invitation to extensively or actively scan our network or information systems for vulnerabilities. We continuously monitor our corporate network, which means there is a good chance we will detect your scan. This may result in legal action being taken against you.

Criminal Prosecution

During your investigation, you may inadvertently carry out activities that are considered criminal offenses under applicable law.

If you comply with the conditions listed below, we will not take legal action against you. However, we would like to point out that the Public Prosecution Service always has independent authority, and in some cases the obligation, to initiate criminal proceedings.

What We Ask of You

• Describe your findings in as much detail as possible and email them to ResponsibleDisclosure@Justspark.com.
• Do not misuse your findings. For example, do not download more data than necessary to demonstrate vulnerability, or access, delete, or modify data belonging to others.
• Share the vulnerability only with us until the issue has been resolved.
• Immediately delete all confidential information obtained through the vulnerability once you have followed the agreed communication procedure.
• Do not carry out attacks involving physical security, social engineering, distributed denial-of-service (DDoS), spam, or third-party applications.

What We Promise You

• Within three days, you will receive an email response from us acknowledging your report. This response will include our procedure for securely and confidentially exchanging additional information.
• Once this information has been exchanged, we will provide our assessment and an estimated date for resolving the issue.
• We will not take legal action against you, provided that you have not violated the conditions outlined above.
• We will treat your report as confidential and will not share your personal information with third parties without your consent, unless we are legally required to do so. If you prefer, you may submit your report anonymously using a pseudonym.
• We will keep you informed about the progress and developments in resolving the issue.
• When communicating with affected parties or the press, we will mention your name as the person who discovered vulnerability only if you wish us to do so.
• We may offer you a reward for your research, but we are not obligated to do so. You are therefore not automatically entitled to compensation. The type and amount of any reward will be determined by us on a case-by-case basis. In making this decision, we may consider the care taken during your research, the quality of your report, and the severity of vulnerability. Under no circumstances will Justspark pay a reward if the reporter attempts to demand or enforce payment.