Security Policy

Scope

Testing under this policy is permitted for the following targets:

• reaktly.com and its subdomains, including the public website, the booking flow, and newsletter signup.
• Only services that are open to you as a visitor. Do not sign in with credentials that are not yours.

Out of scope

We ask you to refrain from the following, even where it may be technically reachable:

• Attacks that degrade or take down the service (denial of service, load testing, high-rate fuzzing).
• Social engineering against our staff, customers, or partners.
• Accessing or altering other people’s data, or creating real identities or accounts that are not yours.
• Third-party services we use (for example Cloudflare, Google, our hosting provider). Please contact the respective provider.
• Reports about best-practice deviations alone (such as missing security headers on preview environments) without a concrete attack.

How to report

Send your report to [email protected]. Encryption is available on request; send us your public key.

To let us work quickly, please include:

• the affected URL or component,
• a reproducible description or a minimal example (steps to reproduce),
• the potential impact,
• how you wish to be credited and a contact for follow-up questions.
• Please share only the data needed to describe the issue. Personal data of others is off limits.

What you can expect from us

We handle reports as follows:

• Acknowledgement within three business days.
• An initial assessment within ten business days: we confirm the issue, rate it, or explain in a traceable way why we do not treat it as a vulnerability.
• A note once a fix has shipped. If remediation takes longer, we will tell you.
• Coordinated publication: as a rule we credit your report only after the fix and after checking with you.

Good faith

If you follow this policy, we treat your research as authorised and will not pursue legal action against you. Please contact us before doing anything beyond passive observation.

This commitment does not apply if you access data without consent, modify or delete data, degrade the service, or sell or pass on vulnerabilities to third parties.

Compensation

We do not run a bug bounty programme with fixed tiers. We compensate substantiated, impactful reports on a case-by-case basis.

A reward is not a condition for reporting and not a guaranteed consideration. We will tell you during the process whether we offer one.

Automated testing and AI agents

Even though this website is public, we do not treat it as express permission for automated testing. We ask for restraint in scanning and testing without human approval.

We read reports from automated tooling when they are substantive. Follow-up questions require a reachable person to be named.