Vulnerability Disclosure Policy

If you find a vulnerability in Direkto, we want to hear about it. This policy explains how to report it, what we ask of you, and what you can expect from us.

1. Who we are

Direkto is a service of QSR2go Operations B.V., trading as Plexaris (hereinafter: Plexaris), located at Waaier 30b, 2451 VV Leimuiden, the Netherlands, Chamber of Commerce number 62031619.

2. What this policy covers

the portal at portal.direkto.org;
the endpoints at mcp.direkto.org;
the addresses of connected businesses under direkto.org.

Please report vulnerabilities in services of others that we use, such as our hosting or database provider, to that provider directly.

3. How to report

Send your report to frank@plexaris.com. This address is also listed in the security.txt file on portal.direkto.org and mcp.direkto.org. Describe what you found, where, and how to reproduce it. You may write in Dutch or English.

4. What we ask of you

Do not view or keep more data than you need to demonstrate the problem, and delete anything you kept once the problem has been fixed.
Do not change or delete data belonging to others.
Do not disrupt the service: no attacks that overload Direkto.
Do not use social engineering, phishing or physical access.
Do not share the vulnerability with anyone else until it has been fixed.

5. What you can expect from us

We confirm receipt of your report within five working days.
We assess your report, tell you what we will do with it, and keep you informed until the problem has been fixed.
We treat your report and your details as confidential and do not share your details with others without your consent, unless the law requires us to.
If you report in good faith and follow section 4, we will not report you to the police or take legal action against you.

6. Contact

Plexaris
frank@plexaris.com
Waaier 30b, 2451 VV Leimuiden, the Netherlands
Chamber of Commerce: 62031619