Report a vulnerability

Email your findings as soon as possible after you discover the vulnerability. Give us enough information to understand and reproduce the issue, and include at least:

• The URL or part of MotorMonitor where the vulnerability is.
• A description of the issue and its potential impact.
• The steps to reproduce the issue, with screenshots or a proof of concept where possible.
• Your contact details, so we can reach you with questions or updates.

• Do not exploit the vulnerability, and go no further than needed to demonstrate the issue.
• Do not view, modify or delete other people's data, and use your own test account where possible. If you do come across personal data, do not keep it and delete it after your report.
• Do not attack availability, for example with (D)DoS, and do not overload the site with automated scans.
• Do not use social engineering or phishing, and do not target our users, suppliers or physical locations.
• Do not install malware or backdoors, and do not change anything on our systems.
• Do not share the vulnerability with others until we have fixed the issue.

• We respond to your report within 5 working days with an initial assessment.
• We treat your report confidentially and do not share your personal details with third parties without your permission.
• We keep you informed of our progress and aim to fix the issue within 90 days.
• If you follow the conditions on this page, we will not report you to the police or take legal action against you because of your report.
• If you wish, we will credit you by name as the finder once the issue is fixed.

This policy covers motormonitor.nl, our subdomains and the MotorMonitor APIs. It does not cover:

• Vulnerabilities in third-party websites, such as the marketplaces and dealer websites whose listings we show. Please report those to the party concerned.
• Output from automated scanners without demonstrated impact.
• Missing security headers, cookie attributes or email settings (SPF, DKIM, DMARC) without a concrete abuse scenario.
• Clickjacking on pages without sensitive actions, and self-XSS.
• Missing rate limiting on forms or endpoints that are not sensitive.
• Reports about software versions without a working exploit.

MotorMonitor does not run a bug bounty programme, so we do not pay a fixed reward per report. We do appreciate every report that makes MotorMonitor safer.