Policy for Security Researchers
Schwarte Jansky takes reports of potential vulnerabilities seriously and aims to enable safe, coordinated remediation. This policy describes the permitted framework for security testing and reporting.
Important notice: This policy is not a general authorization to access third-party systems and does not override applicable law, third-party rights, or contractual obligations.
Scope
The scope includes publicly accessible websites and online services under the schwarte-jansky.com domain, as well as products and software developed or distributed by Schwarte Jansky. Third-party services, components, or infrastructure are included only where Schwarte Jansky expressly operates them as part of the affected product.
Permitted Testing
- Test only with your own accounts, your own devices, or with explicit authorization.
- Limit testing to the minimum technically necessary and stop as soon as a vulnerability has been demonstrated.
- Avoid service disruption, load testing, denial-of-service, social engineering, phishing, physical attacks, and automated mass scanning.
- Do not access third-party data. If such data becomes visible unintentionally, stop testing, do not store or distribute the data, and mention the incident in your report.
- Do not modify or delete production data, and do not install persistent access, malware, or backdoors.
- Do not use the vulnerability for extortion, financial gain, or further attacks.
Reporting
Provide a non-destructive proof, the affected product or system, its version, reproducible steps, potential impact, and, where known, a suggested remediation. Your name and contact details are optional. In the initial report, do not send active credentials, private keys, complete personal data sets, or operational malicious code. Please use the report form.
Coordinated Disclosure
Publish details only after coordinating with Schwarte Jansky and allowing a reasonable period for investigation, remediation, and notification of affected customers. Urgency, product life cycle, supply chains, and required regulatory notifications may affect processing time.
Good-Faith Research
If you comply with this policy and clearly act in good faith, Schwarte Jansky will generally not pursue its own legal action in relation to the research described. This does not apply to intentional harm, extortion, misuse of data, activity outside the stated scope, or legal obligations. Schwarte Jansky cannot make commitments on behalf of law-enforcement authorities or third-party rights holders.
Response and Rewards
Schwarte Jansky aims to acknowledge receipt within five business days and provide an initial assessment within ten business days. These time frames are non-binding targets. No compensation is paid for reported vulnerabilities; any entitlement to rewards or public recognition exists only where expressly agreed in writing in advance.
Privacy
Information about the processing of report and contact data is available at the report form and in the privacy notice. Anonymous reporting is possible.
Language version
Translations are provided for convenience. In the event of discrepancies, the German version prevails.
Last updated: 12 October 2026