Responsible disclosure

How to report

E-mail [email protected]. Please include:

• the page or address it concerns;
• what the problem is and what someone could do with it;
• the steps to reproduce it (a screenshot helps);
• how we can reach you. Reporting anonymously is fine too.

This covers www.365fanatic.com and 365fanatic.nl. Our suppliers' services (such as hosting, Cloudflare and Microsoft) are out of scope; please report problems there under their own policy.

What we ask of you

• Report it as soon as possible after you find it.
• Do not view, copy, change or delete more data than needed to show the problem.
• No attacks that disrupt or load the site (denial of service, large automated scans), no spam, no social engineering or phishing, and no physical attacks.
• Do not post anything on the site and do not leave a backdoor or other software behind.
• Do not share the problem with others until it is fixed, and delete any data you obtained afterwards.

What we promise

• A reply within five working days with our assessment and when we expect to fix it.
• If you follow these agreements, we will not report you to the police or take legal action against you.
• We treat your report confidentially and do not share your details without your permission.
• We keep you informed and fix it as quickly as we can.
• If you wish, we credit you as the finder when we publish about the problem.

Reward

We have no bug bounty programme and give no monetary reward. Automated scanner output without a worked-out, demonstrable risk is not treated as a vulnerability; reports mainly asking for a reward are not answered.

Based on the NCSC Coordinated Vulnerability Disclosure guideline. Also listed in security.txt. Last updated on 27 september 2026.