Security

How to report

Email admin@redo.pro, in English or Danish. Say what you found, where, and the steps that show it, with screenshots or a short proof of concept if you have them. Please keep it between us until it is fixed.

We have no encryption key for reports yet, so email travels as it usually does. Leave out passwords, keys and anyone else's data: describe where they are instead, and we will agree a safer way to share them if we need them.

The same contact is in our security.txt.

What we do with it

• We tell you we have it, and keep you posted while we look into it.
• We fix what we find, and tell you when it is fixed.
• If you want, we credit you for it, by the name you choose.

Research in good faith

Research done in good faith is welcome, and we don't treat it as an attack when it keeps to these limits:

• Test with your own account, or accounts whose owners agreed. Don't look at, change or delete anyone else's data; if you come across some, stop there and tell us.
• Don't slow ReDo down or take it offline for others: no denial of service, and no scanning that floods it with requests.
• No phishing or other tricks on people, and nothing physical.
• The services ReDo runs on belong to their own companies: test them only under their rules.
• Give us time to fix what you found before you tell anyone else.