I’ve found a security issue (responsible disclosure)

If you discover a security issue or vulnerability on Billogram’s platform, we would like to know about it so we can take steps to fix it as quickly as possible.

What is in scope?

We do not accept low-risk findings that fall into the following categories:

• DDos or DoS attacks
• Missing HTTP headers
• Insecure email (DMARC, SPF, DKIM) configurations.
• Descriptive error messages (e.g. stack traces)
• Banner disclosure on common/public services
• Disclosure of known public files or directories, (e.g. robots.txt)
• Clickjacking and issues only exploitable through clickjacking
• CSRF on forms that are available to anonymous users (e.g. contact form)
• Logout Cross-Site Request Forgery (logout CSRF)
• TLS/SSL Attacks such as BEAST, BREACH, Renegotiation attack. As well as insecure cipher suites and non-enabled forward secrecy.
• Social engineering attacks, including those targeting or impersonating internal employees by any means
• Server configuration issues (e.g. open ports, TLS versions, etc.)

We might not answer to submissions that include any of the low-risk findings above, unless a demonstrable PoC can be provided.

What should be included in my report?

• A detailed description of the vulnerability and where you found it. Preferably with an URL or IP address.
• A step by step guide on how to reproduce the issue. 
• If you want updates regarding the issue, include your contact details and public PGP key.

Where do I send it to?

• E-mail your findings to [e-mail]. We prefer that you encrypt your findings using our PGP key.

What happens after I report my findings?

• We will respond to your report within 7 business days with our validation of the report and keep you informed of the progress towards resolving the findings.
• After the finding has been validated and fixed, we will put your name in our Hall of Fame below. This HoF is a thank you to all who want to make Billogram an even safer product. This is of course optional and can be removed by the reporter at any time.

Our PGP Key

Fingerprint: EE59 D76C C070 2A2A 949D F263 7E97 5203 FA6B E43B

-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBGii5i0BEADVcie3a8eUga9HmKiONyDuSZRLtxjWEBiOU8i4IuwSj7wUBLFK
f2TrQX7MPPqZ2azOeAm6V4/dEoXvHRJHYfu4NVPrMisHPqDegKdetK2wZ70fvYtC
WpR9zfCfYgoW/HrI9k+YK9wQ0qbAVrWWRwoH4Uxe14fCMOtE7m/j1XIjvPVcdtKR
PV985UFqXO5lD2BUUMGv2n0MWFJDAJWiZCvxeUSnQtnfvMIxoMg8es9gR1lA1JhH
IeGzzeOvMauL2YOvMYrb9UkTL9xnHz02XGwSAE3F5NMH5/3aTwiLtdJgB/59RsqR
mXInxFRCaiOUtpUvnbhnrWsfNvhGugoZms7qYQeYujO54oy+ZfLiDRzYuWbIxO5E
DnLWDqGSm1a2KqrolL5FyhwE8HBxxXyGQGzEP1TkBKRQMUypBa/VDBxLKi+FdB4l
KoXOvX7eCizydn4Y0yxv23tJ6NJTt+Tho2Mj8TPF8vjyf8fUvbqTWbxrg33CFwsn
W9cI0IEBdRZK/cH2tBhiOiqu4VdYYGuj5GxySpAyx23xQz6qC2zKTmAhMy8/bwdZ
FyI6CwpFsviNOggBzszO/Br4obzY+KkiroX/S6tsqxXMSe+AaacH+uHUxR0V5u0s
GveX0s5QQ1yr0XjK3qDUHR1YfbHXo/sL0HQoVALEKm+zfivojiLBlHwdHwARAQAB
tC9zZWN1cml0eUBiaWxsb2dyYW0uY29tIDxzZWN1cml0eUBiaWxsb2dyYW0uY29t
PokCVAQTAQgAPhYhBO5Z12zAcCoqlJ3yY36XUgP6a+Q7BQJoouYtAhsDBQkHhh8l
BQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEH6XUgP6a+Q7QHsP/iJCvktkLm88
ilXaoUNaRplOAurbldTHJOhIvv5GdmgVPh1k5o2WsuGOxgEJOnuYaF6wrfqVIgUk
vBC5buXIfbWFBIDByw2v8RSBuQf8/pedgRsGWqG84iaSN0U/DgyAsltMGW/SAnA9
iQaoWlvSe1NfQeU1lI6/TGuSrOpqZiw58A7cChJWFJe95b9q/std67u/769aEPC1
qq5a8n4bd1b02gEmwvdeXOxcHS/fM1Y3gjjTQRDseJbyS/6DwOzcyUnS03Me7tsG
IIVdNzqvyerWpujFDxKCsoiwW/wEtpRbZwwD4QiVl7vCMttyVTLs4ueouTfBN3R9
mBftvVWllkDPazkVyCsqZgLKP0K5lkqhnE+ABHOT3FQxq/cVVJweUku++SExsH31
S9wTA0v9lQFeePku1K4IkKzCVWnpe1ZFSEe4rvDu7WfUX7Gd3EiD/VLsL82le0Lv
/QZfj3JRgydzg/ssQh0gAiDsziDbKoIXf7z1oQU5L5ffSFf0xYtquI1ZC/oBgl1G
Uyrk7qLKWasMupP6eD3WkVvHlKaoAnj/8yjrxy4szGgDBie2AfJnOHYC5qkgTw5c
9FQQhmsSNjI6ot1lM+3FBUX/HUR3VYZHQHXWtg5GfpfSKDR8W3zTPQjcxNYzbafb
J/eywxrL1ya6Ldn/WdtXxpUIFjNyQrORuQINBGii5i0BEADkOaylSBMhUD08TEi1
3og2dFPQvuZULxpXWqq65GyqTIBp6j2wyy1EDpBT6LrCeyWUZtdyR7pqs+C42DMg
g+eS3sqf0pIqiei9eLj6feSp/lcaWPFLzywGP6RSlu8c8EMAwpz1u54BSAgBK7Ga
0OVniV+Axi/LHSkeqR7lKDAysfOYXXWlasavEI8O3UKFqPNdQPJKOv69Me5aWyO1
5xhdtAA102Ws9s8SZN4Fj88SX3lkS5Ah8CIpRraY5dBJWPiJXRPKSw0Z4tOxMY4D
HlMe6WhA5pKKHo4silMOYgYSjLe3DHO+DaLy0hOlXploPRDRCktg06JCzr1b9pvp
ND+uE7y5z29ItZRK89l5dpEC4rJafbw3IWJdh2zFNwMrDDj5ErrsL0bt5MrQDG4N
MLmL4vOVl6DGdExxS+Sj4Ei/iXnAke7Sh+MCf0G2/7Makv+kiBUYiIXTSe5Mrw0/
h4Onz+jsETweAkiDWW4VOtwt5u4iMqJwTIj4DrfjUTTvcFbSRRM443xAf0lfL/oP
mMFPuRsKbyRFU0iL/Xz2/QBLOl+Jb8gcQtHHVGmcNSwwnt5WMXOyVdmvdv240ZJX
fJtmgrITkygYOkR7TA1I7/uxocaYZml3YYlDNDD9V7ARIJkFm759cY5BShiAvmHr
ucmpGBioNw8JSoL25ZDiOJge5QARAQABiQI8BBgBCAAmFiEE7lnXbMBwKiqUnfJj
fpdSA/pr5DsFAmii5i0CGwwFCQeGHyUACgkQfpdSA/pr5DsccBAAte/U0CxVbbUs
rHCPZ8Gsm4QkBOkwmsCAPbNqH/UVbJEYl1UJn1t/7r/OIuKpsyjJNliOXWY8XUmq
0TFIpCQ+W27ID1tAr4BjkyoZcZ8+wX30hRaGkg1JGdRlT/c6kH42I8o1rVTlIYQG
dfDkfjkGs3Bc5VBIJYZEKN7SzeQghDLpd7CXpc4pZ2lSXRikc6sRlU4x5vilh0No
2UoJpIftSi1eafte9+zrx5iTiUZUOJ1uJQBR3U/N5hezmnrYw+0Mei2hKxa5nzGr
QLpCt3v59/lpo0fDalYEWOUUCpaiKyMqxkOH7qCjIhpqMDSqhWMjmIRDG61cM2gj
v0J9J+Gd9PXg5neDtJoYrM318N0cKFRLadoEqoON9HlfVGLNirQyidw4gmgYOBeq
P8KjCqhx3CVYnOvC0bGfhV026/oIypBkq8jQJPbUiOzN6Re+M6BE2o+rsjVGxg5N
e8zbyjVciEIUIF+3xwaTblv0AXjG+vJS734DGtsGManjIXpHobK4oh+KAjdZGxPT
dlhya6K1q+YeQNFvm1LC+oQRe7iwyX+YmuiHBQhJ1mGcSGpDAymVmybSCzQv8OUC
z5cHNiZEjzUL87Ull6GiICST6dFWvnZwT9/Z/jg4jtwsrC/b9zaYfcBLDK4VGvPz
CBqnRyr+3nATJ8I6pzIeEBaZuT0Fglw=
=aano
-----END PGP PUBLIC KEY BLOCK-----

Can't find what you're looking for?

During the day you can chat with us, you do so by clicking the chat box in the right corner. If you prefer to contact us in another way you find our contact information here.