Security
Coordinated vulnerability disclosure
How to report a security issue in theseeus.eu: scope, safe harbour, and response times. No bug bounty.
Last reviewed 2026-08-22.
Last reviewed 2026-08-22.
Coordinated vulnerability disclosure for the theseeus.eu website and its source repository. This is not a bug-bounty programme. Practice follows the idea of CVD as described around NIS2 Article 12 and ENISA’s CVD guidance — report in good faith, allow time to fix, do not put users at extra risk.
Scope
- https://theseeus.eu and preview hosts that serve this codebase.
- The public git repository that builds the site.
- Misconfiguration that would disclose non-public data or take the site offline.
Out of scope: content accuracy of the legal explainer, third-party sites we link to, and denial-of-service testing that degrades the service.
How to report
Prefer a private report: a security advisory on the repository if that channel is enabled, or
the contact in /.well-known/security.txt
. Include the URL or commit, what you observed, and a way to reach you.
Safe harbour
If you act in good faith, stay within this scope, do not access more data than needed to demonstrate the issue, do not exploit it further, and give us a reasonable chance to fix it before public disclosure, we will not treat that research as an attack and will not pursue legal action for it. This is not a licence to break the law.
Response times
- Acknowledgement: within 5 business days.
- Initial assessment: within 10 business days of acknowledgement.
- Fix or public status for a valid issue: commensurate with severity; we aim to patch high-impact host issues before discussing them in public.
No bounty
There is no payment for reports. We can credit researchers who want to be named once a fix is out.