1. Scope
In scope: the website at https://rechazo.si and anything we operate under that domain.
Out of scope:
- our service providers' systems (Resend, our host, our mailbox provider). Report issues there to them directly;
- social engineering, phishing or physical attacks against us or anyone else;
- denial-of-service or load testing;
- spam or automated bulk submissions to the waitlist form;
- missing "best-practice" headers or settings with no demonstrable impact;
- findings that need an already-compromised device or browser.
2. Safe harbour
If you act in good faith and follow these rules, we will:
- treat your research as authorised and won't pursue or support legal action against you for it;
- work with you to understand and fix the problem;
- tell you when it's fixed.
This is our promise as the site operator. It can't bind other companies (such as our providers) or law enforcement.
3. Rules
Please:
- Test only against your own data and sessions. Don't access, change, keep, or share other people's data. If you accidentally see personal data, stop and tell us.
- Stop at proof. Use the minimum needed to show the issue exists. Don't try to pivot, persist, or "see how far it goes."
- Don't degrade the Site (no flooding, no destructive actions).
- Don't publish details until we've had a reasonable time to fix (see section 5).
- Don't submit real credentials, secrets or sensitive data in your report; redact them.
4. How to report
Email security@rechazo.si. Include:
- what you found and where (URL, steps to reproduce);
- impact: what an attacker could do;
- proof-of-concept (screenshots or short code), with any real data redacted;
- how you'd like to be credited, or that you want to stay anonymous.
If you want to send details privately, ask for a secure channel in your first email and we'll arrange one (e.g., an encrypted message).
5. What happens next
| Step | Our target |
|---|---|
| Acknowledge your report | within 3 business days |
| First assessment (valid? severity?) | within 7 days |
| Fix or mitigation for serious issues | within 30 days where possible; we'll keep you updated if it takes longer |
| Public disclosure | coordinated with you; 90 days from report is our default outer limit, shorter if fixed sooner |
We're a small team, so these are good-faith targets, not guarantees.
6. Recognition
We can't offer cash rewards at this stage. With your permission we'll credit you by name or handle in a thank-you list once the issue is fixed, and we're happy to write a short reference on request.
7. If you think your data is affected
If you believe your personal data on our Site was exposed, email security@rechazo.si and hello@rechazo.si. We follow a written incident-response process and will tell you what we find.
8. Machine-readable contact
Our contact details are also published in security.txt, following RFC 9116.