Vulnerability disclosure

Anyone who finds a security vulnerability in freestays can report it to the operator, SnapNext GmbH & Co. KG. This page describes how this is planned to work (coordinated disclosure).

Contact

Email: support@freestays.app

Please use "Sicherheitsmeldung" in the subject line. Reports in German or English are welcome. Please do not make a vulnerability known through public channels before it has been fixed.

Scope

In scope are the freestays platform and the trust center at trust.freestays.app. Out of scope are services of third parties that freestays uses, such as hosting and database providers. Please report vulnerabilities there directly to the respective provider.

What a report should contain

• a short description of the vulnerability and its possible impact,
• the affected address or function,
• the steps to reproduce it, ideally with a sample request or screenshot,
• date and time of the test and, if applicable, the identifier or IP address used,
• a way to contact you for follow-up questions.

What we do

• We confirm receipt of a report.
• We review the report and get in touch if we have questions.
• We intend not to pursue legal action against research carried out in good faith that follows these rules. This wording is subject to legal review and is not a binding commitment.
• We inform you about the fix if the reporting person wishes.

Time frames are targeted, not promised: We aim to confirm receipt promptly and to keep you informed of progress. Specific deadlines have not been set yet.

What we expect

• Access data only as far as necessary to demonstrate the vulnerability. Do not download or share data of other people.
• Do not change or delete data, and do not disrupt operation.
• No denial-of-service tests, no spam, no social engineering against staff or users.
• Use only your own accounts or accounts whose owners have agreed.
• Give us reasonable time to fix the issue before publishing details.

No reward

There is no reward program and no bug bounty. A hall of fame is not promised. If you want to be named, say so in the report, and we decide case by case.

Personal data in reports

We process the information in a report to handle it and to stay in contact with the reporting person. The information is used only for that purpose, as intended. If you have inadvertently viewed personal data, please say so in the report.

Details for security.txt

Planned for the security.txt file on the platform:

The Expires field is mandatory for the file and is set at release to a date at most one year ahead. Until then no value has been set.