Reporting vulnerabilities
If you have found a bug that puts user data at risk - write to us. We take such reports seriously and answer every one of them.
How to report
Send a message to [email protected] with "security" in the subject line.
Describe:
- what the problem concerns and where it shows up,
- the steps needed to reproduce it,
- what you think could happen if somebody exploited it.
We write in Polish and in English. We reply within 5 working days - including when the report turns out to be a false alarm.
What we ask of you
Do not send personal data of children, or screenshots containing anyone's data. A description is enough to reproduce a bug. This is not a formality - a report with a screenshot of someone else's data creates exactly the problem you are trying to help us solve.
Do not test in ways that could harm other users: no mass password guessing, no load testing, no reaching into other people's accounts. If you need a second account to confirm a bug, create your own.
Give us time to fix the issue before you describe it publicly. We run no financial bounty programme, but we will gladly thank you by name if you would like that.
What it covers
- the
czasnato.comwebsite and its pages, - the web app at
czasnato.com/app/, - the CzasNaTo mobile app.
The external services we use - Supabase and Cloudflare - have their own reporting channels. Report a bug in their infrastructure directly to them.
For automated tools
The same information in
RFC 9116 format is available in
/.well-known/security.txt.