Security

We build software for regulated industries and networks for buildings, and we hold our own website to the same standard. We welcome reports from security researchers and take every credible report seriously.

Use the message form and choose the topic ‘Security report’. Please include:

• the affected URL or component;
• a description of the vulnerability and its impact;
• the steps to reproduce it, or a proof of concept;
• how we can reach you, and whether you would like to be credited.

Include no more personal data or exploit output than you need to. If you prefer, send a summary first and we will agree a more secure channel for the details. If you cannot use the form, write to us by post; the address is on the company details page.

This policy covers developernetwork.pl and www.developernetwork.pl only.

Our clients’ systems, networks and buildings are not in scope. That includes software we build or maintain for clients and the UniFi and KNX installations we look after. We cannot authorise anyone to test them; only their owners can. We also do not disclose who our clients are. Report problems in another organisation’s systems directly to that organisation.

• denial-of-service attacks of any kind;
• social engineering, including phishing, aimed at our people or our clients;
• physical attacks on our premises, equipment or people;
• spam, and volumetric or automated abuse of the contact forms;
• reports from automated scanners without a demonstrated impact;
• vulnerabilities in Cloudflare’s own services, which should be reported to Cloudflare.

• Do not access or change more data than you need to demonstrate the issue, and delete any data you obtained once you have reported it.
• Do not disrupt the site or degrade it for others.
• Do not use the vulnerability for anything other than demonstrating it.
• Give us reasonable time to fix the problem before you disclose it publicly: 90 days from your report, unless we agree otherwise.
• Comply with the law.

• We will acknowledge your report within 5 business days.
• We will keep you informed while we investigate and fix the issue, and tell you when it is resolved.
• With your consent, we will credit you when we disclose the issue.

We do not run a bug bounty programme and do not pay for reports.

If you act in good faith and follow this policy, we will consider your research authorised, and we will not take legal action against you or report you to law enforcement because of it. This applies only to developernetwork.pl and www.developernetwork.pl; we cannot give permission to test anyone else’s systems. If you are unsure whether something is allowed, ask us first through the message form.

Our contact details for security reports are also published in machine-readable form at /.well-known/security.txt, as described in RFC 9116.