Skip to content
PARTYPPLSecurity
NederlandsTo partyppl.nl

Responsible disclosure

Report a vulnerability

If you spot something wrong, we would rather hear it from you than from somebody else. Below is how to report it, what is in scope and what you get back from us.

How to report

Use the form below or mail security@partyppl.nl. A person reads that address. Tell us what you found, on which URL or in which app, and how to reproduce it. A short clip or a couple of screenshots help more than a forty-page scanner report.

You can encrypt sensitive details with our PGP key. You do not have to: an unencrypted report beats no report.

The machine-readable policy is in security.txt, on each of our addresses.

What you get back

  1. An incident, or a report that could put other people's data, logging in, payments or tickets at risk: a person responds within 1 to 2 hours. Always, weekends included.
  2. A general security question, or a report without a direct risk: an answer from a person within 1 to 2 working days, not an autoresponder.
  3. Within ten working days you hear whether we accept it, what we think the impact is and when we will fix it.
  4. Once it is fixed, you hear so and you are free to publish. We ask you to wait 90 days before publishing, or less when we are done sooner. If it takes longer, we tell you why.

In scope

  • Everything on partyppl.nl and each of its subdomains (*.partyppl.nl, gaming.partyppl.nl included), and the short address pppl.app.
  • The apps for iPhone, iPad, Apple Watch, Mac and Apple TV.
  • The API under /api/v1, the MCP server, the Apple Wallet service, pairing an Apple TV and the widget feeds.
  • The mail we send.
  • Examples: reaching another account's data, bypassing login, the 18+ step or the roles, injection, getting a ticket without paying or somebody else's ticket, reading other people's uploads.

Out of scope

  • Denial of service, load tests and anything that makes the site slower for others.
  • Social engineering of our team, organisers or visitors, and phishing.
  • Physical access to offices, servers or devices.
  • Spam, also to our mail sender or push notifications.
  • A bare scanner report, missing headers without a working exploit, self-XSS, and the TLS settings of our CDN provider.
  • Third-party services such as Stripe, Resend, Cloudflare, OVHcloud, Apple or Anthropic. Take those to them.

Ground rules for testing

  • Test on your own account and your own data only. If you reach somebody else's data, stop right there, keep nothing, and say in your report how much you saw.
  • No automated scans against login, payment and tickets. Those hit real visitors at the door.
  • No charging back real payments, no scanning or reselling other people's tickets.
  • Do not change or delete anything that is not yours, leave no back door and do not keep access once you have shown that you could.
  • Share what you found with nobody else until it is fixed.

Safe harbour

Report in good faith and stay within the ground rules above, and we will not report you to the police or take you to court. We then see your research as help, not as an attack.

We cannot promise that on behalf of others: not for our suppliers, and not for the Public Prosecution Service, which decides on its own whether to prosecute. More on coordinated disclosure in the guidance of the NCSC.

Reward

PartyPPL is a small platform without a security department. We pay no money reward. What we do: answer quickly, be honest about what we will and will not fix, and credit you by name if you want that.

Hall of fame

Everyone who reports a vulnerability we confirm and fix is listed here, under the name or handle you pick, with the month and one line about what it was. Anonymous is fine too.

Nobody yet. No report has been confirmed so far. This list is empty because it is honest, not because it was forgotten.

PGP key

Encrypt sensitive details with our key. Check the fingerprint first:

E5D2 6476 4523 7FA9 9C0C A348 34DE 15CF CFE7 5F58

Report form

Goes straight to security@partyppl.nl. You do not need an account.

We answer on this. We send nothing else to it.
For example: other people's tickets visible through the ticket link.
An address starting with https://, or leave it empty and name the app in your explanation.
If yes, we look at it within a few hours, weekends included.
What did you do, what happened, what did you expect? Do not put other people's real data in it.
Empty is anonymous.

You cannot attach files here. A link to a clip or a file is fine in your explanation, or mail us and ask for a safe way.

We use your address and your report only to handle your report, and keep them in our mailbox and our own report system, for at most 24 months. See the privacy statement.