Security

Report a security vulnerability

If you found a weakness in euphile.eu or in one of the platform products, tell us. We read every report, we answer every reporter, and we credit you when the issue is fixed.

Your report

Fields marked with * are required. Write in English if you can. We also read reports in every EU language.

Summary *

One line, for example: Stored XSS in the project name field.

Product *

Your severity estimate *

Type of issue *

Affected address or component *

The URL, host, API endpoint, app version or file where the issue appears.

Description *

What is the weakness, and where is it?

Steps to reproduce *

Numbered steps we can follow, with the requests and responses that matter.

Impact *

What could an attacker do with it, and to whom?

CVSS vector (optional)

For example CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Link to a proof of concept (optional)

A private link to a video, screenshots or a script. Do not include other people's data.

Suggested fix (optional)

Accounts and source IP addresses you tested from (optional)

This helps us tell your tests apart from an attack in our logs.

About you

Name or handle (optional)

Email address *

We use it only to contact you about this report.

Credit me by name in the acknowledgements when the issue is fixed.

Name to credit (optional)

Leave empty to use the name above.

I have read the rules below and followed them while testing. *

This website keeps no copy of your report. It goes straight to our security team, who keep it only as long as they need to handle the issue and to credit you.

The rules

Version 1, in force since October 17, 2026.

What you can test

euphile.eu and every service under euphile.eu: the applications, the administration consoles and the APIs.
The ten platform products, including their desktop applications and add-ins, in their latest released version.
Any other system we operate that holds customer data.

What is out of scope

Services that third parties run and we only use. Report those to their owner.
Denial of service, load tests, and any test that slows down or interrupts the service for others.
Social engineering, phishing and physical attacks on our staff, our customers or our offices.
Results from automated scanners without a demonstrated, exploitable impact.
Missing security headers, cookie flags or email authentication records, unless you show a concrete attack.
Self-XSS, clickjacking on pages without a sensitive action, and disclosure of software versions.
Prompts that make an AI model say something unwanted, unless they cross a security boundary: another customer's data, a secret, or an action the user is not allowed to take.

How to test

Use only accounts you own, or accounts whose owner has given you written permission.
If you reach data that is not yours, stop. Do not copy, keep or share it, and say so in your report.
Do only what is needed to prove the issue: no changes or deletions, no persistence, and no movement to other systems.
Keep automated traffic below 5 requests per second.
Do not share the details with anyone until we have released a fix, or until 90 days after your report, whichever comes first. We can agree on another date together.
Do not ask for payment in exchange for not disclosing. That is extortion, not research.

What we commit to

We confirm receipt within 2 business days.
We send a first assessment, with our severity rating, within 5 business days.
We keep you informed at least once a month until the issue is resolved.
We tell you when the fix is released, and we agree with you on when the advisory is published.
With your consent, we credit you by name in the advisory and in the acknowledgements.

Safe harbour

If you act in good faith and follow these rules, we consider your research authorised. We will not take legal action against you for it, and we will not support anyone who does.
If a third party takes action against you for research that followed these rules, we will make it known that your research was authorised.
This applies to systems we own and operate. We cannot authorise tests on systems that belong to someone else.

Rewards

Every valid report is credited, with your consent.
For an original finding of high or critical severity, we may offer a financial reward. We decide whether to offer one, and its amount, based on the impact and the quality of the report. A reward is not guaranteed.
When several people report the same issue, the first complete report counts.
We cannot pay a reward where the law forbids it, or to anyone who broke these rules.