DefenceLevel
Security reports
If you find a vulnerability in DefenceLevel's systems, we want to know. This page explains how to report it, what we ask of you and what we commit to doing.
How to report
Write to security@defencelevel.com stating:
- the affected system or address;
- a description of the problem and its possible impact;
- the steps to reproduce it (requests, parameters, screenshots);
- how you prefer to be contacted and, if you wish, the name under which you would like to be thanked.
You can write to us in English or Italian.
Scope
In scope: the defencelevel.com website and its subdomains, the defencelevel.eu and defencelevel.it domains, the subscriber dashboard, the service functions and the emails we send.
Out of scope: the services of our providers (Vercel, Supabase, Resend, Stripe, OVHcloud), which should be reported directly to them; third-party vulnerabilities that we describe in the briefing, which should be reported to the respective vendors.
What we ask of you
- Do not access, modify or delete other users' data: if you happen to see any, stop and let us know.
- Do not degrade the service: no denial-of-service attacks, load tests or mass sending of requests or emails.
- No social engineering against us or our users, no physical attacks, no use of other people's accounts.
- Give us reasonable time to fix the problem before making it public.
What we commit to doing
- Acknowledge receipt of the report within 5 working days.
- Keep you informed about the assessment and the fix.
- Thank you publicly, if you wish, once the problem is resolved.
- Not take legal action against anyone who reports in good faith and in accordance with the rules on this page.
We do not currently offer financial rewards for reports.