Report a security issue

This is a translation. Only the Dutch text is legally binding; in case of any difference, it prevails.

Last updated: 30 September 2026

Have you found a vulnerability in one of our systems? Thank you for reporting it to us. This page explains how we handle reports, what we do and do not reward, and what you can expect from us.

1. How to report something

Email security@tromptech.nl. For sensitive reports you can encrypt with our PGP key (available on request).

Include in your report:

A clear description of the problem and its impact
Steps to reproduce it (a working example if possible)
The URL or component where you found it
Whether you want to be on our hall of fame, and if so, under what name

2. What we promise

Confirmation of receipt within 2 working days
First substantive response within 5 working days
Status updates at least every 14 days until the report is resolved
No legal action against researchers who follow these rules
A mention on our hall of fame if you wish

We do not currently pay a cash reward for reports, but we do thank you with a small gift, a discount on our services or a mention. For exceptional findings we are open to a tailored arrangement.

3. What we value

SQL injection, XSS, CSRF, SSRF, RCE
Problems with login and access rights
Access to other people's data (IDOR, broken access control)
Data leaks (personal data, keys, tokens)
Configuration errors with security consequences (open storage, public databases and the like)

4. What we consider less relevant

Missing security headers without a concrete consequence
Self-XSS
Theoretical CSRF on public read-only pages
SPF, DKIM and DMARC without a working phishing example
High-traffic attacks (DDoS, brute force)

5. Ground rules

Give us reasonable time to respond before you make anything public (guideline: 90 days)
No damage to our data, services or customers
No brute force, no high-traffic attacks, no deception (social engineering) of our staff or customers
Only test on your own account or a test account. Ask us if you need a test account.
If you reach other people's data, report it immediately and do not download it

6. Scope

In scope:

tromptech.nl and all subdomains
The TrompTech Layer workspace (app.tromptech.nl)
Our API endpoints (/api/*)
Our automations that can be reached at a direct address

Out of scope:

Sites we have built for clients on their own domain
Third-party services we use (such as Vercel, Supabase and OpenAI): report those directly to them
Our admin environment (it requires permission, so research is not possible)