Reporting a security issue

Keelstamp is operated by PowerQuant ApS, Denmark. If you think you have found a security weakness in something we run, we want to hear about it. Thank you for taking the time to tell us.

What this covers

Keelstamp is in development and has not been released yet. Today, this policy covers our website at keelstamp.com. When parts of the product go live, we will add them here.

Not covered:

• Services run by other companies that we use, such as our hosting or email providers. Please report those to the provider.
• Denial-of-service or load testing.
• Spam or social engineering of our team or anyone else.
• Physical attacks.
• Output from automated scanners that does not show a real impact.

How to report

Email security@keelstamp.com. English or Danish is fine.

Please tell us:

• what you found, and where,
• the steps to reproduce it,
• what you think the impact is.

We do not have a PGP key yet. Please keep secrets and personal data out of your first email. If we need more detail, we will agree on a safer way to share it.

What we ask of you

• Act in good faith, and only test with accounts and data that belong to you.
• Look at no more data than you need to show the problem. If you come across someone else's data, stop, do not keep a copy, and tell us.
• Do not change or delete data, and do not slow the service down for others.
• Give us a fair chance to fix the issue before you share it publicly. We will agree on a date with you.

What you can expect from us

• We read every report, and we will reply to you.
• We are a small team, so we do not promise fixed response times. If you have not heard back within two weeks, please send us a short reminder.
• We will keep you updated while we look into it, and let you know when it is fixed.
• If you would like, we will credit you by name when we publish anything about the issue.
• We do not run a bug bounty, so we cannot pay for reports.