Gedachten Makelaar takes the security of its platform seriously. If you discover a vulnerability, we appreciate you reporting it responsibly so we can resolve it quickly.
How to report a vulnerability
Send an email to security@gedachtenmakelaar.nl with a clear description of:
- The nature of the vulnerability
- The URL or component of the platform where you found it
- Steps to reproduce the issue
- Any screenshots or proof-of-concept (no exploitation of real user data)
What to expect from us
- We will acknowledge receipt within 2 business days
- We will provide a substantive response within 5 business days
- We will keep you informed of progress
- We ask that you do not disclose the issue publicly until we have resolved it
- We will not pursue legal action against researchers who follow these guidelines
In scope
- The Gedachten Makelaar web application (gedachtenmakelaar.nl)
- Platform API endpoints
- Authentication and authorisation flaws
- Unintended exposure of user data
Out of scope
- Third-party infrastructure (Supabase, Vercel, Stripe, Daily.co)
- Social engineering or phishing attacks on staff
- Denial-of-service attacks
- Reports generated by automated scanners without manual verification
Bug bounty
We do not currently offer financial rewards. Researchers who report a significant vulnerability and follow these guidelines may be publicly acknowledged upon request.