How to report a vulnerability
Email your findings to security@datacation.nl. Give us enough detail to reproduce the problem. Usually that means:
- the URL, endpoint or IP address that is affected
- what the vulnerability is, and what an attacker could do with it
- the steps to reproduce it, such as a request and response, a short script or screenshots
- where you found it: on our live website or on a test environment
You can write to us in Dutch or English.
What we ask of you
To protect our users and their data, we ask you to:
- report the problem to us as soon as you can after finding it
- do no more than you need to show the problem exists. Don't download more data than necessary, and don't view, change or delete other people's data
- keep the problem to yourself until we have fixed it
- not use social engineering, phishing or physical attacks against Datacation or our staff
- not run denial-of-service attacks, spam or automated load tests, or do anything else that slows the service down for real users
- not install a backdoor or leave anything behind on our systems. If a proof of concept has to create something, tell us what you created, so we can clean it up
What we promise
- We confirm that we received your report within 3 working days.
- Within 7 working days we send you our assessment and, where we can, an expected date for the fix.
- We keep you posted while we work on a fix, and we tell you when the problem is solved.
- We treat your report as confidential. We don't share your personal details with third parties without your permission, unless the law requires us to.
- If you followed the rules on this page and acted in good faith, we won't take legal action against you over your report.
- If you like, we name you as the person who found the problem when we publish about it.
- We aim to solve the problem within 60 days of your report. We decide together with you whether and when details are made public. If a fix takes longer, we'll tell you why.
We don't run a paid bug bounty programme and we don't pay for reports. Good-faith reports are still very welcome.
What this policy covers
In scope
- www.datacation.nl and everything under it, including /admin and /api
- the staging and test environments of this website
- passwords, API keys or other Datacation credentials that you find exposed
Out of scope
- third-party services we use, such as Vercel, Microsoft Azure, MongoDB Atlas, HubSpot, Google and LinkedIn. Please report those to the provider
- automated scanner results without a demonstrated impact, such as a missing header on a static file, a version number in a banner or an outdated library that can't be reached
- denial-of-service and load testing
- social engineering, phishing and physical access
- unfinished content on our test environments, unless it points to a defect in the code
More information
Security tools and scanners can find our contact details in /.well-known/security.txt.
Our privacy policy explains how we handle the personal data in your report.
Last updated on 16 October 2026.