Reporting a Security Vulnerability
This is an English translation for convenience. The Czech version is legally binding; in case of any discrepancy, the Czech version prevails. Česká verze
Have you come across a bug that someone could exploit — to access other people’s data, bypass login or disrupt operation? We would be glad if you let us know before anyone who would exploit it finds out about it.
How to report
- Write to podpora@pridom.cz with the subject “Security vulnerability”.
- Describe where the bug is, how to trigger it, and what in your view it makes possible. Brief is enough.
- Do not send us other people’s personal data that you may have seen — it is enough to describe what you were able to reach.
What to expect from us
- We will usually confirm receipt of the report within two working days.
- We will assess and fix the bug according to its severity; we will keep you informed of progress.
- If you wish, after the fix we will credit you as the discoverer. If not, you remain anonymous.
- We do not promise fixed deadlines for a fix. Serious bugs are handled as a priority.
- A breach of the security of customers’ personal data is additionally handled by the procedure under the Data Processing Agreement.
Rules of the game
- Test only on your own accounts or on the public demo, never on other customers’ data.
- Do not disrupt operation (no flooding, no deleting other people’s data) and do not download anything in bulk.
- Give us reasonable time to fix the bug before you disclose it.
We will not take any legal action based on a report made under these rules against a finder acting in good faith. This promise cannot be extended to conduct that breaches the rules above.
Contact: podpora@pridom.cz