CertReadiness

Security & Vulnerability Disclosure

Last updated: 2026-08-20

CertReadiness takes security seriously. We welcome reports from security researchers, learners and partners. This page is our Coordinated Vulnerability Disclosure (CVD) policy — the internal version lives in docs/CVD.md.

How to report

Mail security@certreadiness.com with:

  1. A clear description and impact assessment.
  2. Reproduction steps or a proof of concept.
  3. Your handle for optional public credit.

Machine-readable pointer: /.well-known/security.txt (RFC 9116).

A PGP key will be published soon; until then, plain email is fine.

Scope

In scope: certreadiness.com and its subdomains, the Vercel preview domain, the web app, and the /api/* HTTP surface.

Out of scope: third-party vendors (Supabase, Vercel, Anthropic — report to them directly), denial-of-service, findings without demonstrated impact, and social engineering of staff or learners.

Our response commitments

  • Acknowledgement: within 5 business days.
  • Triage decision: within 10 business days.
  • Fix or mitigation for confirmed critical/high: within 30 days.
  • Disclosure coordination: timing agreed jointly with the reporter.

Safe harbor

If you make a good-faith effort to comply with this policy, we consider your research authorised under the Dutch Computer Crime Act and will not initiate or support legal action against you.

Good faith means: do not access, modify or exfiltrate data that is not your own; do not degrade the service; give us reasonable time to fix before public disclosure; stop and notify us if you encounter user data.

Rewards

We do not currently run a paid bug-bounty program. For material findings we offer public credit and a token of appreciation.

Sub-processor list

Full sub-processor inventory lives on /privacy. At the time of writing: Supabase (Frankfurt), Vercel, Anthropic (US, opt-in AI features only), Cloudflare, and a transactional email provider being finalised.

Contact