BEARCLAVE
← Back to the home page

Vulnerability disclosure policy

In effect from 15 September 2026

Have you found a security vulnerability on bearclave.cz or in its infrastructure? Let us know. This page describes how to report it and what to expect from us. The machine-readable contact is in /.well-known/security.txt.

Where to report

By e-mail to security@bearclave.cz, or to data box h3irc3m. Reports are accepted in Czech and in English.

Please include a description of the vulnerability, the affected address or service, the steps to reproduce it and the impact you believe it carries. Do not send personal data of third parties or real data obtained through the finding.

What to expect from us

  • Acknowledgement of receipt within 3 working days.
  • An initial assessment and a decision on how to proceed within 10 working days.
  • Information about the fix, or about why we do not consider the finding a vulnerability.
  • Our thanks and, if you wish, credit by name once the issue is fixed.

We pay no bounties. Bearclave does not run a vulnerability reward programme.

Scope

In scope is the bearclave.cz domain including its subdomains and the public endpoints reachable from it.

Out of scope are the environments of Bearclave customers, third-party services, findings from automated scanning without demonstrated impact, missing optional headers without demonstrable risk, the output of rating services such as TLS configuration grades, and reports about e-mail records that match the published configuration.

Rules of testing

  • Do not test denial of service, load or volumetric attacks.
  • Do not use social engineering against people, and do not phish.
  • Do not work with other people's data. If you come across it, stop testing and write to us.
  • Do not delete or change data or configuration, and do not degrade the availability of the service.
  • Do not publish the finding until it is fixed or until we agree on publication.

If you keep to these rules, we treat your work as help given in good faith and will take no legal action against you. This page is not a waiver of statutory rights and does not replace the consent of the owner of somebody else's infrastructure.