Report a vulnerability

How to report

Please use our contact form at https://www.accountdesk.de/en/contact and start your message with “Security”.

Describe the issue so that we can reproduce it: affected address or component, steps to reproduce and the possible impact.

Scope

• the application at my.accountdesk.de, including the addresses of individual workspaces
• the public API and the MCP endpoint for AI applications
• the support widget (@accountdesk/widget)
• the desktop and mobile app
• this website www.accountdesk.de

Please do not

• access, change or delete other customers’ data – use a test account of your own
• attack availability (denial of service), send spam, use social engineering or physical attacks
• use scanning tools (e.g. vulnerability scanners, port scanners, fuzzers) – please test manually
• send large numbers of automated requests, for example to guess passwords or probe rate limits
• publish the vulnerability before it has been fixed

What we commit to

• confirmation of receipt within 3 business days
• an initial assessment within 10 business days
• a fix according to severity: critical within 7 days, high within 30 days
• updates on progress and on the fix
• credit in an acknowledgement, if you wish

No legal action

We will not take legal action against anyone who acts in good faith and within these rules.

Rewards

We do not currently run a bug bounty programme.