SECURITY
Report vulnerabilities responsibly.
EU Anchor welcomes good-faith reports that help us improve the security of systems and services we own or operate.
1. How to report
Email security@euanchor.eu with enough information for us to understand and reproduce the issue.
If possible, include:
- affected host, URL, service or component;
- a clear description of the vulnerability and potential impact;
- reproduction steps or a minimal proof of concept;
- date/time of testing and the source IP address(es) you used;
- any evidence needed to confirm the issue without unnecessarily exposing personal or confidential data.
2. Scope
This policy applies to EU Anchor's publicly accessible websites at euanchor.eu and www.euanchor.eu. Staging, customer and internal environments, administration interfaces, third-party systems and infrastructure accounts are excluded. Security testing of excluded environments requires prior written authorisation from EU Anchor. Domain association alone does not authorise testing.
If you are uncertain whether a system is in scope, contact us before testing it.
3. Good-faith testing guidelines
Please do
- use the minimum testing necessary to demonstrate the issue;
- stop testing if you encounter personal data, credentials or other sensitive information;
- report the issue promptly and keep it confidential while we investigate;
- give us reasonable time to remediate before any public disclosure;
- provide validation if automated tools identify a possible issue.
Please do not
- disrupt service availability or perform denial-of-service testing;
- use social engineering, phishing, physical attacks or attacks against employees;
- perform credential stuffing or password spraying;
- delete, modify, download or retain data beyond what is strictly necessary to demonstrate the issue;
- run high-volume automated scans that could affect availability or create operational noise.
4. Coordinated disclosure
Please do not publicly disclose a suspected vulnerability before EU Anchor has had a reasonable opportunity to investigate and remediate it. We will work with good-faith reporters toward coordinated disclosure where public disclosure is appropriate.
Depending on severity and complexity, remediation may require coordination with suppliers or open-source projects. A period of up to 90 days may sometimes be appropriate before public disclosure, although the actual timeline depends on severity, exploitation risk and remediation progress. This is a coordination guideline, not an unconditional disclosure deadline.
5. Response target
EU Anchor's target is to acknowledge a credible vulnerability report within five business days. This is an operational target for the disclosure process, not a contractual service-level agreement.
6. Researcher information and confidentiality
EU Anchor will use reporter information to investigate and coordinate the security report. We will not publish a reporter's identity without permission unless disclosure is required by law.
This policy does not grant permission to access systems unlawfully or to violate the rights of third parties. Researchers should act proportionately, minimise impact and comply with applicable law.
7. Rewards
EU Anchor does not currently operate a public bug-bounty programme. Submission of a vulnerability report does not create an entitlement to payment or other reward.
8. security.txt
EU Anchor publishes a machine-readable security contact at /.well-known/security.txt.
The file contains our security contact, preferred languages, policy link and expiry date. For vulnerability reports, email security@euanchor.eu.